How to configure acme-companion for path based routing

[sid203]

Hi

I have been using path based routing feature of ngìnx-proxy for multiple containers running services. Currently I have the following setup of nginx-proxy, whoami & portainer successfully running together.

version: '3.2'

services:
  reverse-proxy:
    image: nginxproxy/nginx-proxy:1.6
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
    ports:
      - "8080:80"
    networks:
      - reverse_proxy_network
    deploy:
      mode: global
      placement:
        constraints: [ node.platform.os == linux ]

  whoami:
    image: jwilder/whoami
    networks:
      - reverse_proxy_network
    environment:
      - VIRTUAL_HOST=staging.dev.it
      - VIRTUAL_PORT=8000
      - VIRTUAL_PATH=/whoami/
    deploy:
      mode: replicated
      replicas: 1

  portainer:
    image: portainer/portainer-ce:2.20.3
    command: -H tcp://tasks.agent:9001 --tlsskipverify
    volumes:
      - portainer_data:/data
    environment:
      - VIRTUAL_HOST=staging.dev.it
      - VIRTUAL_PORT=9000
      - VIRTUAL_PATH=/portainer/
      - VIRTUAL_DEST=/
    networks:
      - nginx_reverse_proxy_network
      - agent_network
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [ node.role == manager ]

networks:
  ....
volumes:
  ....

DNS for the VIRTUAL_HOST=staging.dev.it points to a registered IP address which is a google compute VM. By declaring the VIRTUAL_PATH env variable I can access the whoami & portainer services on the following urls:

• whoami -> staging.dev.it:8080/whoami/
• portainer -> staging.dev.it:8080/portainer/

How do I configure the acme-companion for these two containers (whoami is just a mock service here and I will be deploying more services in the same manner as above)? What should be the values of the environment variable LETSENCRYPT_HOST? Essentially I have only a single domain staging.dev.it which is actually registered on a DNS provider and I just need to figure out how to configure acme-companion for such a setup that uses path based routing.

[sid203]

Alright so I kind of figured it out. For my case all the services will be using a common virtual host i.e. staging.dev.it/app1, staging.dev.it/app2 and so on, thus an SSL certificate should be issued only for this domain. This can be done by setting the LETSENCRYPT_HOST variable only on one of the services and omitting from all other services.

The updated docker compose file is as follows:

whoami:
    image: jwilder/whoami
    networks:
      - reverse_proxy_network
    environment:
      - VIRTUAL_HOST=staging.dev.it
      - VIRTUAL_PORT=8000
      - VIRTUAL_PATH=/whoami/
    deploy:
      mode: replicated
      replicas: 1

  portainer:
    image: portainer/portainer-ce:2.20.3
    command: -H tcp://tasks.agent:9001 --tlsskipverify
    volumes:
      - portainer_data:/data
    environment:
      - VIRTUAL_HOST=staging.dev.it
      - VIRTUAL_PORT=9000
      - VIRTUAL_PATH=/portainer/
      - VIRTUAL_DEST=/
      - LETSENCRYPT_HOST=staging.dev.it 
    networks:
      - nginx_reverse_proxy_network
      - agent_network
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [ node.role == manager ]

After deploying the above file the services will be available on staging.dev.it/portainer/ & staging.dev.it/whoami/ and both the services will share the SSL certificate obtained through acme-companion.