Multiple sublevel domain for one secondlevel : wohto

[pascal-linux]

This is a question on how to solve the following problem:
How should I indicate within the docker-compose.yml the main domain if I use several subdomains (in different dockers) based on the same second level domain?
Example:
Docker 1 : docker-compose.yml: <Application 1>
...

• VIRTUAL_HOST=example.de,sub1.example.de,sub2.example.de
• LETSENCRYPT_HOST=example.de,sub1.example.de,sub2.example.de
  ...
  Docker 2 : docker-compose.yml: <Application 2>
  ...
• VIRTUAL_HOST=example.de,sub3.example.de,sub4.example.de
• LETSENCRYPT_HOST=example.de,sub3.example.de,sub4.example.de

((This could even be more complicated if I also want "example.com" to point to the same host/docker, i.e.

• VIRTUAL_HOST=example.de,example.com,sub3.example.de,sub4.example.de,sub3.example.com,sub4.example.com
• LETSENCRYPT_HOST=example.de,example.com,sub3.example.de,sub4.example.de,sub3.example.com,sub4.example.com

My problem is that when the SSL is created for the "application 2" the SSL-certificates for "application 1" gets lost / is no longer valid.

Maybe it is not OK to set the "main domain" (example.de and/or example.com) as first entries in both docker-compose??

Thanks a lot,
Pascal

[buchdag]

Maybe it is not OK to set the "main domain" (example.de and/or example.com) as first entries in both docker-compose??

You got this right, you can't have the same base domain ( = first entry) for two different containers.

Additionally you can't reuse the same domain on different containers VIRTUAL_HOST. nginx-proxy redirect each incoming request with a given SNI to one container and one container only.

[pascal-linux]

Thanks for your answer!
Would it be a solution to set just the complete domain name (which is - of course - different for all containers) - i.e.
Docker 1:

• VIRTUAL_HOST=sub1.example.de,sub2.example.de
• LETSENCRYPT_HOST=sub1.example.de,sub2.example.de
  Docker 2:
• VIRTUAL_HOST=sub3.example.de,sub4.example.de
• LETSENCRYPT_HOST=sub3.example.de,sub4.example.de

Or is there any other solution using frontproxy/SSL-companiopn?
Thank you for your help!
Pascal

[buchdag]

Let me complete my previous answer as it was quite uncomplete.

First regarding nginx-proxy and the VIRTUAL_HOST variable:

You can't reuse domains for more than one container. That's a basic principle of a reverse proxy based on SNI in general and of nginx-proxy specifically, you can't proxy to more than one service on the same port(s) (80/443 in our case) for a given domain, as the proxy will have no way to tell which request must go to which backend service.

So

container1
VIRTUAL_HOST=example.com,sub1.example.com

...

container2
VIRTUAL_HOST=example.com,sub2.example.com

doesn't work, because in the configuration file that nginx-proxy dynamically creates, only one of those two containers can receive the requests for example.com.

[buchdag]

The way letsencrypt-nginx-proxy-companion works with certificates in conjunction with nginx-proxy is a bit more complex.

The companion will attempt to create / renew a certificate for every LETSENCRYPT_HOST environment variable found on a container, wether the variable values is the same as another or not.

The ACME client (simp_le) on the other hand won't try to recreate a certificate that cover the same set of domains as an existing and still valid certificate in its working directory.

BUT, because the companion put certificates in folders named after the first domain in the LETSENCRYPT_HOST variable (the "base domain") things like example.com,sub1.example.com and sub1.example.com,example.com are considered as two different certificates by the container because the ACME client will be working inside different directories.

For example, something like

container1
VIRTUAL_HOST=example.com,sub1.example.com
LETSENCRYPT_HOST=example.com,sub1.example.com,sub2.example.com
...

container2
VIRTUAL_HOST=sub2.example.com
LETSENCRYPT_HOST=example.com,sub2.example.com,sub1.example.com

(same base -first- domain, same set of domains, different ordering)

Will work and generate only one certificate if the two containers are started at the same time. If you don't start both at the same time, the first certificate creation will fail as one of the domains (sub2.example.com) won't be configured inside nginx-proxy, resulting in failing challenge authorization. Starting the second container should make the certificate creation succeed as all the domains covered by the certificate are now configured inside nginx-proxy.

You could, theoretically, have a a hundred containers each with a single domain as VIRTUAL_HOST and all sharing the same certificate with a hundred domains long LETSENCRYPT_HOST variable.

This is however not a recommended way of using this container and considered unsupported for now, as the container lacks the mechanics needed to make it work consistently.

The recommended way is that each container have its own set of domains, and that all the domains set in the LETSENCRYPT_HOST variable of a container be also set on its VIRTUAL_HOST variable. You can set additional domains in the VIRTUAL_HOST variable of the container but they'll result in certificate errors when you'll try to use those domains to access the proxyed service.

[pascal-linux]

Thank you so much for your explanation! I got it now (i hope so at least).
Would it then be possible to have the whole domain name as VIRTUAL_HOST AND LETSENCRYPT_HOST?
i.e.

container1

VIRTUAL_HOST=sub1.example.com
LETSENCRYPT_HOST=sub1.example.com

container2
VIRTUAL_HOST=sub2.example.com
LETSENCRYPT_HOST=sub2.example.com

...

container-n
VIRTUAL_HOST=sub-n.example.com
LETSENCRYPT_HOST=sub-n.example.com

If that does the trick, everything is perfect...
Then there is no need to put the general "example.com" at the beginning of each
VIRTUAL_HOST and LETSENCRYPT_HOST.

Thanks,
Pascal

[buchdag]

Yes, this is the "normal" way of using those two containers together.

Do you mind me asking why you thought adding example.com in front of each VIRTUAL/LETSENCRYPT_HOST variables values was required ?

[pascal-linux]

OK, that really helps me..
To answer your question: I do not know anymore. Maybe it was because auf your examples
where you set the secondlevel domain always at the beginning (example.com,www.example.com,mail.example.com) ..

$ docker run -d \
    --name example-app \
    -e "VIRTUAL_HOST=example.com,www.example.com,mail.example.com" \
    -e "LETSENCRYPT_HOST=example.com,www.example.com,mail.example.com" \
    -e "[email protected]" \
    tutum/apache-php

But as this is not needed everything is fine.
Once again thanks for your great contribution and your answers!!