Automatic TLS

A secure first connection, with a little less certificate administration.

Let’s Encrypt with HTTP-01

Configure DR_ACME_EMAIL, point DNS at the server, and allow incoming HTTP on port 80 and HTTPS on port 443. Add dr.tls: auto on the service. DockRouter handles the ACME challenge and certificate lifecycle.

environment:
  DR_ACME_EMAIL: you@example.com
# Application service labels:
labels:
  dr.enable: "true"
  dr.host: "app.example.com"
  dr.tls: "auto"

HTTP-01 does not issue wildcard certificates. Every requested hostname must resolve correctly and be reachable for validation.

Additional names

Use dr.tls.domains for additional SAN hostnames. All requested names must satisfy the certificate provider’s validation requirements.

dr.tls.domains: "example.com,www.example.com"

Bring a certificate

Set dr.tls to manual and provide both certificate and key paths as seen inside the router container. Mount those files into DockRouter. Manual TLS does not require an ACME email.

dr.tls: "manual"
dr.tls.cert: "/certs/app/cert.pem"
dr.tls.key: "/certs/app/key.pem"

Test issuance before production

Use DR_ACME_STAGING=true while testing your deployment to avoid production issuance rate limits. Staging certificates are not publicly trusted. Restore the production provider setting when the deployment is ready.