I’ve been self hosting traditionally in debian, but I would like to be able to add services easier using docker. As such, I’m looking to move to a container based architecture.
One place I struggle is that I can’t seem to find a good container where the default image supports ACME to support Let’s encrypt for automatic cert renewal.
For Nginx, I would have you build my container. HAproxy ACME support seems to be a shell script.
Any suggestions?
You must log in or register to comment.
This is usually where something like Traefik comes in. It will reverse proxy the docker instance and it can be configured to handle let’s encrypt. The are also other options I like nginx proxy manager and I think Caddy also can do this, by I don’t have experience with that.
I’m considering moving to Talos, so I imagine Traefik would work better in k8s right?
Traefik also supports running on K8s, yes.
On that note, if you’re moving to K8s, I recommend looking into K8s Gateway API, it’s the successor to the old Ingress API. There are other, more complete, implementations of it than Traefik. See https://gateway-api.sigs.k8s.io/
Which gateway implementations would you recommend?
I’m looking to support HTTPS and Webdav
I’m using istio (in ambient mode, so it doesn’t put its sidecar into every pod I create), and Nextcloud behind it, works flawlessly. It does consume a bit of time to set up properly though.
TLS certificates are handled via cert-manager, which works with both Ingress and Gateway API, independent of which implementation you choose.
I’ve also tried envoy gateway (had issues with uploading larger files via Nextcloud Web UI and Gradle publish to maven repo).
Cilium (a CNI) also has an integrated Gateway and Ingress API implementation, works fine, but lacks some of the most recent stable features, and quite some experimental features. But if you just need a HTTPS gateway without much fuss, it’s rock-solid. Setup time is also minimal for the Ingress/Gateway controller part. Cilium CNI on the other hand takes a lot of time to understand and configure, if you’re unfamiliar with networking in general.
Traefik’s featureset is comparable with Cilium’s Gateway API implementation, also works, simple to setup, and might be better suited, if you’re already familiar with it using docker, as it’s the same concepts, just slightly different config (docker labels vs. Ingress/Gateway API with Traefik specific annotations).
Caddy supports the HTTP-01 and TLS-ALPN-01 challenges by default, you just need to expose 80/443 and it just works. But if you want to use the DNS-01 challenge you’d need to build it with a plugin of your DNS provider.
Traefik supports all 3 challenges equally ootb, with a wide range of DNS providers. But it is a bit harder to configure and doesn’t support being a web server.
I didn’t understand, why not use nginx? It has built in support for let’s encrypt by default, you just have to activate it in the nginx config. https://nginx.org/en/docs/http/ngx_http_acme_module.html
I use Zoraxy and it is great if you like GUIs.
Don’t know if this fits for your use case but I am in love with pangolin.
You might check docker swag. It’s got built in certbot client and has preconfigured support for a couple hundred common self-hosted services.
I use:
- Apache with Letsencrypt client for single host reverse proxies or those with more complex needs. Not the easiest but when you understand it, it’s fine. Lightweight, solid and very flexible.
- NPM (Nginx Proxy Manager), either service or docker, where there’s a lot of proxies on one host. Very simple, very reliable, baked in authentication.
- Traefik, when building or deploying services, especially with docker swarm. Tags make it very smooth once you’ve got things set up and in your workflow.
All are good choices, but each has a specialism that make it a little bit better than the others.
Take a look at Zoraxy or NPM.
Npm and npmplus are great
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System HTTP Hypertext Transfer Protocol, the Web HTTPS HTTP over SSL SSL Secure Sockets Layer, for transparent encryption TLS Transport Layer Security, supersedes SSL VPS Virtual Private Server (opposed to shared hosting) k8s Kubernetes container management package nginx Popular HTTP server
[Thread #122 for this comm, first seen 28th Feb 2026, 06:40] [FAQ] [Full list] [Contact] [Source code]
You can bake haproxy and acme.sh into a container yourself. Haproxy is hands down the best performing/least resource consuming RP. Dynamic management, like mimicing Traefiks service discovery, can be a bit tricky though. Yes, it doesn’t support ACME itself but once you get passed the “hello world” RP’ing and need something more advanced, like ACME DNS01, Haproxy with acme.sh is your buddy for life.
