As I see, you havenot exposed port 443 for nginx container:

nginx:
      build: ./nginx
      ports:
         - 80:80
         - 443:443
      depends_on:

Add more 443 port.

I see in your setup you try to run let's encrypt from within the nginx container. But I believe there is a better way that I describe in details here. The idea is to have a docker-compose file to initiate the letsencrypt certificate, and another docker-compose file to run the system and renew the certificate.

So without further ado, here is the file structure and content that is working really well for me (you still need to adapt the files to suit your needs)

• ./setup.sh
• ./docker-compose-initiate.yaml
• ./docker-compose.yaml
• ./etc/nginx/templpates/default.conf.template
• ./etc/nginx/templpates-initiation/default.conf.template

The setup in 2 phases:

In the first phase "the initiation phase" we will run an nginx container, and a certbot container just to obtain the ssl certificate for the first time and store it on the host ./etc/letsencrypt folder

I the second phase "the operation phase" we run all necessary services for the app including nginx that will use the letsencrypt folder this time to serve https on port 443, a certbot container will also run (on demand) to renew the certificate. We can add a cron job for that. So the setup.sh script is a simple convenience script that runs the commands one after another:

#!/bin/bash
# the script expects two arguments:
# - the domain name for which we are obtaining the ssl certificatee
# - the Email address associated with the ssl certificate
echo DOMAIN=$1 >> .env
echo EMAIL=$2 >> .env

# Phase 1 "Initiation"
docker-compose -f ./docker-compose-first.yaml up -d nginx
docker-compose -f ./docker-compose-first.yaml up certbot
docker-compose -f ./docker-compose-first.yaml down

# Phase 2 "Operation"    
crontab ./etc/crontab
docker-compose -f ./docker-compose.yaml up -d

Phase 1: The ssl certificate initiation phase:

./docker-compose-initiate.yaml

version: "3"
services:
  nginx:
    container_name: nginx
    image: nginx:latest
    environment:
      - DOMAIN
    ports:
      - 80:80
    volumes:
      - ./etc/nginx/templates-initiate:/etc/nginx/templates:ro
      - ./etc/letsencrypt:/etc/letsencrypt:ro
      - ./certbot/data:/var/www/certbot
  certbot:
    container_name: certbot
    image: certbot/certbot:latest
    depends_on:
      - nginx
    command: >- 
             certonly --reinstall --webroot --webroot-path=/var/www/certbot
             --email ${EMAIL} --agree-tos --no-eff-email
             -d ${DOMAIN}
    volumes:
      - ./etc/letsencrypt:/etc/letsencrypt
      - ./certbot/data:/var/www/certbot

• ./etc/nginx/templates-initiate/default.conf.template

  server { listen [::]:80; listen 80; server_name $DOMAIN; location ~/.well-known/acme-challenge { allow all; root /var/www/certbot; } }

Phase 2: The operation phase

./docker-compose.yaml

services:
  app:
    {{your_configurations_here}}
  {{other_services...}}:
    {{other_services_configuraitons}}
  nginx:
    container_name: nginx
    image: nginx:latest
    restart: always
    environment:
      - DOMAIN
    depends_on:
      - app
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./etc/nginx/templates:/etc/nginx/templates:ro
      - ./etc/letsencrypt:/etc/letsencrypt
      - ./certbot/data:/var/www/certbot
      - /var/log/nginx:/var/log/nginx
  certbot:
    container_name: certbot
    image: certbot/certbot:latest
    depends_on:
      - nginx
    command: >-
             certonly --reinstall --webroot --webroot-path=/var/www/certbot
             --email ${EMAIL} --agree-tos --no-eff-email
             -d ${DOMAIN} 
    volumes:
      - ./etc/letsencrypt:/etc/letsencrypt
      - ./certbot/data:/var/www/certbot

server { listen [::]:80; listen 80;

server_name $DOMAIN;

return 301 https://$host$request_uri;

}

./etc/nginx/templates/default.conf.template

server {
    listen [::]:443 ssl http2;
    listen 443 ssl http2;

    server_name $DOMAIN; 

    ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
    }

    access_log  /var/log/nginx/access.log;
    error_log   /var/log/nginx/error.log;

    location / {
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Proto https;
      proxy_pass http://app:80;
  }
}