[Help]: Any examples of automating letsencrypt certificate renewal for use with docker-omada-controller?

[daubman]

Controller Version

5.15.20.10

Describe Your Issue or Question

I'm looking for examples or suggestions on how best to automate letsencrypt certificate renewal and container cycling when renewed. I previously manually managed my omada controller install (non-dockerized) and set up certbot, but never got to fully automating the cert renewal there... I'm guessing this is a solved problem folks have good experience with and I can learn from and copy some tried and working approaches. I'm especially interested in folks who use a wildcard certificate for omada (installed, not proxied) but also use that same wildcard cert for other services - e.g. copying it from certbot or another solution to the SSL_CERT_NAME location while also copying it to other locations...

Expected Behavior

Letsencrypt certificate auto-renews before expiration

Steps to Reproduce

n/a

How You're Launching the Container

services:
  omada-controller:
    container_name: omada-controller
    image: mbentley/omada-controller:beta-chromium
    restart: unless-stopped
    ulimits:
      nofile:
        soft: 4096
        hard: 8192
    stop_grace_period: 60s
    networks:
      macvlan-lan-7:
        ipv4_address: 192.168.7.10
    environment:
      - PUID=508
      - PGID=508
      - MANAGE_HTTP_PORT=8088
      - MANAGE_HTTPS_PORT=8043
      - PORTAL_HTTP_PORT=8088
      - PORTAL_HTTPS_PORT=8843
      - PORT_APP_DISCOVERY=27001
      - PORT_ADOPT_V1=29812
      - PORT_UPGRADE_V1=29813
      - PORT_MANAGER_V1=29811
      - PORT_MANAGER_V2=29814
      - PORT_DISCOVERY=29810
      - PORT_TRANSFER_V2=29815
      - PORT_RTTY=29816
      - SHOW_SERVER_LOGS=true
      - SHOW_MONGODB_LOGS=false
      - SSL_CERT_NAME=tls.crt
      - SSL_KEY_NAME=tls.key
      - TZ=America/New_York
    volumes:
      - omada-data:/opt/tplink/EAPController/data
      - omada-logs:/opt/tplink/EAPController/logs

networks:
  macvlan-lan-7:
    external: true

volumes:
  omada-data:
  omada-logs:

Container Logs

n/a

MongoDB Logs

n/a

Additional Context

No response

[mbentley]

So I am using acme.sh, which is similar to certbot. In this case, I am using the functionality of acme.sh that allows you to specify a reload command after renewal (which happens automatically via cron). I am using DNS challenges so that removes the need to do any manipulation/serving of any files to act as a challenge.

My reload command calls a shell script that copies the generated certs to the specific directory and then restarts the controller:

cp /path/to/my/certs/from/acme.sh/fullchain.cer /data/omada-controller/cert/tls.crt
cp /path/to/my/certs/from/acme.sh/my.domain.key /data/omada-controller/cert/tls.key
docker restart -t 30 omada-controller