[Third-party] Cloudflare proxy DNS, SSL encryption mode must be set to "Full" (or Full strict) about docker-nginx-certbot HOT 3 CLOSED

test-nginx-1  | /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
test-nginx-1  | /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
test-nginx-1  | /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
test-nginx-1  | 10-listen-on-ipv6-by-default.sh: info: /etc/nginx/conf.d/default.conf is not a file or does not exist
test-nginx-1  | /docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
test-nginx-1  | /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
test-nginx-1  | /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
test-nginx-1  | /docker-entrypoint.sh: Configuration complete; ready for start up
test-nginx-1  | 2023/10/08 06:14:58 [info] Creating symlink '/etc/nginx/conf.d/default.conf' to '/etc/nginx/user_conf.d/default.conf'
test-nginx-1  | 2023/10/08 06:14:58 [warning] Could not find non-zero size keyfile file '/etc/letsencrypt/live/my.domain.here/privkey.pem' in '/etc/nginx/conf.d/default.conf'
test-nginx-1  | 2023/10/08 06:14:58 [warning] Could not find non-zero size fullchain file '/etc/letsencrypt/live/my.domain.here/fullchain.pem' in '/etc/nginx/conf.d/default.conf'
test-nginx-1  | 2023/10/08 06:14:58 [warning] Could not find non-zero size dhparam file '/etc/letsencrypt/dhparams/dhparam.pem' in '/etc/nginx/conf.d/default.conf'
test-nginx-1  | 2023/10/08 06:14:58 [error] Important file(s) for '/etc/nginx/conf.d/default.conf' are missing or empty, disabling...
test-nginx-1  | 2023/10/08 06:14:58 [info] Starting the Nginx service
test-nginx-1  | 2023/10/08 06:14:58 [info] Running the autorenewal service
test-nginx-1  | 2023/10/08 06:14:58 [notice] 88#88: using the "epoll" event method
test-nginx-1  | 2023/10/08 06:14:58 [notice] 88#88: nginx/1.25.2
test-nginx-1  | 2023/10/08 06:14:58 [notice] 88#88: built by gcc 12.2.0 (Debian 12.2.0-14) 
test-nginx-1  | 2023/10/08 06:14:58 [notice] 88#88: OS: Linux 5.15.0-1040-oracle
test-nginx-1  | 2023/10/08 06:14:58 [notice] 88#88: getrlimit(RLIMIT_NOFILE): 1048576:1048576
test-nginx-1  | 2023/10/08 06:14:58 [notice] 88#88: start worker processes
test-nginx-1  | 2023/10/08 06:14:58 [notice] 88#88: start worker process 94
test-nginx-1  | 2023/10/08 06:14:58 [notice] 88#88: start worker process 95
test-nginx-1  | 2023/10/08 06:14:58 [warning] Couldn't find the dhparam file '/etc/letsencrypt/dhparams/dhparam.pem'; creating it...
test-nginx-1  | mkdir: created directory '/etc/letsencrypt/dhparams'
test-nginx-1  | 2023/10/08 06:14:58 [info] 
test-nginx-1  |     %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
test-nginx-1  |     %                        ATTENTION!                       %
test-nginx-1  |     %                                                         %
test-nginx-1  |     % This script will now create a 2048 bit Diffie-Hellman   %
test-nginx-1  |     % parameter to use during the SSL handshake.              %
test-nginx-1  |     %                                                         %
test-nginx-1  |     % >>>>>      This MIGHT take a VERY long time!      <<<<< %
test-nginx-1  |     %    (Took 65 minutes for 4096 bit on an old 3GHz CPU)    %
test-nginx-1  |     %                                                         %
test-nginx-1  |     % However, there is some randomness involved so it might  %
test-nginx-1  |     % be both faster or slower for you. 2048 is secure enough %
test-nginx-1  |     % for today and quite fast to generate. These files will  %
test-nginx-1  |     % only have to be created once so please be patient.      %
test-nginx-1  |     % A message will be displayed when this process finishes. %
test-nginx-1  |     %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
test-nginx-1  |     
test-nginx-1  | 2023/10/08 06:14:58 [info] Will now output to the following file: '/etc/letsencrypt/dhparams/dhparam.pem'
test-nginx-1  | Generating DH parameters, 2048 bit long safe prime
test-nginx-1  | 198.199.113.86 - - [08/Oct/2023:06:15:57 +0000] "GET / HTTP/1.1" 301 169 "-" "Mozilla/5.0 zgrab/0.x" "-"
test-nginx-1  | 2023/10/08 06:16:03 [info] 
test-nginx-1  |     %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
test-nginx-1  |     % >>>>>   Diffie-Hellman parameter creation done!   <<<<< %
test-nginx-1  |     %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
test-nginx-1  |     
test-nginx-1  | 2023/10/08 06:16:03 [info] Starting certificate renewal process
test-nginx-1  | 2023/10/08 06:16:03 [info] Requesting an ECDSA certificate for 'my.domain.here' (http-01 through webroot)
test-nginx-1  | Saving debug log to /var/log/letsencrypt/letsencrypt.log
test-nginx-1  | Account registered.
test-nginx-1  | Requesting a certificate for my.domain.here
test-nginx-1  | 172.70.131.87 - - [08/Oct/2023:06:16:05 +0000] "GET /.well-known/acme-challenge/2x_Ur21Fz7Ry0KOmsLQW9vu-HAXPhQCGrqoAxFFB09k HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)" "2600:1f16:269:da00:7d0f:9ddb:7a4:7027"
test-nginx-1  | 172.71.147.69 - - [08/Oct/2023:06:16:05 +0000] "GET /.well-known/acme-challenge/2x_Ur21Fz7Ry0KOmsLQW9vu-HAXPhQCGrqoAxFFB09k HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)" "2600:1f14:804:fd01:f453:b83c:88f4:808a"
test-nginx-1  | 162.158.245.74 - - [08/Oct/2023:06:16:06 +0000] "GET /.well-known/acme-challenge/2x_Ur21Fz7Ry0KOmsLQW9vu-HAXPhQCGrqoAxFFB09k HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)" "2600:3000:2710:200::30"
test-nginx-1  | 
test-nginx-1  | Successfully received certificate.
test-nginx-1  | Certificate is saved at: /etc/letsencrypt/live/my.domain.here/fullchain.pem
test-nginx-1  | Key is saved at:         /etc/letsencrypt/live/my.domain.here/privkey.pem
test-nginx-1  | This certificate expires on 2024-01-06.
test-nginx-1  | These files will be updated when the certificate renews.
test-nginx-1  | NEXT STEPS:
test-nginx-1  | - The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.
test-nginx-1  | 
test-nginx-1  | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
test-nginx-1  | If you like Certbot, please consider supporting our work by:
test-nginx-1  |  * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
test-nginx-1  |  * Donating to EFF:                    https://eff.org/donate-le
test-nginx-1  | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
test-nginx-1  | 2023/10/08 06:16:08 [info] Found all the necessary files for '/etc/nginx/conf.d/default.conf.nokey', enabling...
test-nginx-1  | 2023/10/08 06:16:08 [notice] 196#196: signal process started
test-nginx-1  | 2023/10/08 06:16:08 [notice] 88#88: signal 1 (SIGHUP) received from 196, reconfiguring
test-nginx-1  | 2023/10/08 06:16:08 [notice] 88#88: reconfiguring
test-nginx-1  | 2023/10/08 06:16:08 [info] Autorenewal service will now sleep 8d
...

volumes:
  letsencrypt:
services:
  nginx:
    image: jonasal/nginx-certbot
    restart: unless-stopped
    environment:
      - [email protected]
    volumes:
      - letsencrypt:/etc/letsencrypt
      - ./nginx_conf.d:/etc/nginx/user_conf.d:Z
    ports:
      - 80:80
      - 443:443

ssl_certificate /etc/letsencrypt/live/my.domain.here/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/my.domain.here/privkey.pem;
ssl_dhparam /etc/letsencrypt/dhparams/dhparam.pem;

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name my.domain.here;

    location / {
        default_type text/plain;
        return 200 'SSL is working!';
    }
}