Multiple virtual hosts with SSL on one machine

In this article, we’ll set up multiple websites with SSL on one machine using Docker, Docker Compose, nginx, and Let’s Encrypt.

Prerequisites

Nginx proxy

Let’s Encrypt companion

Main Docker Compose file

Let’s start with the main Docker Compose file. It will launch the nginx proxy and Let’s Encrypt companion containers. Create a folder called proxy, then add a docker-compose.yml file with the following content:

version: '3' # Version of the Docker Compose file format
services:
    nginx-proxy:
        image: jwilder/nginx-proxy:alpine
        restart: "always" # Always restart the container
        ports:
         - "80:80" # Port mappings in host:container format
         - "443:443"
        networks:
         - nginx-proxy # Name of the network these two containers will share
        labels:
         - "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy" # Label used by the Let’s Encrypt companion
        volumes: # Volumes for proxy configuration and certificates from the Let’s Encrypt companion
         - /var/run/docker.sock:/tmp/docker.sock:ro
         - "nginx-conf:/etc/nginx/conf.d"
         - "nginx-vhost:/etc/nginx/vhost.d"
         - "html:/usr/share/nginx/html"
         - "certs:/etc/nginx/certs:ro"
    letsencrypt-nginx-proxy-companion:
        image: jrcs/letsencrypt-nginx-proxy-companion
        restart: always
        container_name: letsencrypt-nginx-proxy-companion
        volumes:
         - "/var/run/docker.sock:/var/run/docker.sock:ro"
         - "nginx-conf:/etc/nginx/conf.d"
         - "nginx-vhost:/etc/nginx/vhost.d"
         - "html:/usr/share/nginx/html"
         - "certs:/etc/nginx/certs:rw"
        depends_on: # Start the nginx proxy container first
            - nginx-proxy
networks:
    nginx-proxy: # The shared network used by the containers
volumes: # Shared volumes that persist on the Docker host
    nginx-conf:
    nginx-vhost:
    html:
    certs:

Now run:

docker-compose up -d

The -d flag runs the containers in the background, also called detached mode.

To check the containers’ status, run:

docker ps

Nginx virtual host

Next, we’ll launch a website container. The proxy will route requests to it.

Create a folder called example.com, replacing that name with your own domain. Add a new docker-compose.yml file, and put your website’s files in a subfolder called www. Create another subfolder called nginx, containing Dockerfile and default.conf.

Your example.com folder should look like this:

• www folder with your website’s content
  • index.html
  • etc…
• nginx
  • Dockerfile
  • default.conf
• docker-compose.yml

Dockerfile:

FROM nginx:alpine
COPY ./nginx/default.conf /etc/nginx/conf.d/default.conf # Copy the nginx configuration file
COPY ./www/ /usr/share/nginx/html/ # Copy the website files

default.conf:

server {
	listen 80 default_server;
	listen 443 ssl;

	server_name example.com;

	root /usr/share/nginx/html/;
	index index.html;

	location / {
		try_files $uri $uri/ =404;
	}
}

docker-compose.yml:

version: '3'
services:
    nginx:
        container_name: example-nginx
        image: example-nginx
        restart: always
        build:
            context: ./
            dockerfile: ./nginx/Dockerfile
        environment:
         - VIRTUAL_HOST=example.com # Domain used by the nginx proxy
         - LETSENCRYPT_HOST=example.com # Domain used by the Let’s Encrypt companion
         - [email protected]
        expose:
         - "80" # Expose the HTTP port
         - "443" # and the HTTPS port
        networks:
         - nginx-proxy # Connect to the nginx-proxy network defined below
networks:
    nginx-proxy:
        external:
            name: proxy_nginx-proxy # Use the network created by the main Compose file. Run `docker network ls` to check its generated name.

Everything is ready. Build and start the container:

docker-compose up -d

You should now have three containers running: the nginx proxy to route requests, the Let’s Encrypt companion to manage certificates, and the website container to serve your content.

That’s it!

Your website should now be available over HTTPS!
To add another website, repeat the steps in the Nginx virtual host section.

Rebuilding a container image

If you change the website’s files and need to rebuild its image, run:

docker-compose build

What if something isn’t working?

If a container won’t start, try running it without -d. You’ll see its output directly in the terminal, including stdout and stderr.

To read a container’s logs, use:

docker logs CONTAINER_ID

You can find the CONTAINER_ID in the output of:

docker ps

SNI

SNI (Server Name Indication) lets one host serve different domains with different certificates. You can read more on Wikipedia and check browser support on Can I use.

The example on GitHub

You can find the example project on GitHub. Have fun!