docker-compose.prod.certbot.yml

version: '3.8'

services:

  certbot:
    image: certbot/certbot
    container_name: certbot
    volumes:
      - ./web-app/.well-known/acme-challenge:/var/www/html/.well-known/acme-challenge  # ACME challenge folder
      - ./web-app/ssl:/etc/letsencrypt # Mount SSL keys
    environment:
      - CERTBOT_MODE=${CERTBOT_MODE:-generate} # Mode: 'generate' or 'renew'
    entrypoint: >
      sh -c "
      if [ \"$CERTBOT_MODE\" = \"generate\" ]; then
        certbot certonly \
          --non-interactive \
          --webroot \
          --webroot-path /var/www/html \
          --email ${DOMAIN_EMAIL} \
          --agree-tos \
          -d ${DOMAIN},www.${DOMAIN} \
          --debug --verbose;
      elif [ \"$CERTBOT_MODE\" = \"renew\" ]; then
        certbot renew --quiet;
      else
        echo 'Invalid CERTBOT_MODE specified. Use generate or renew.';
        exit 1;
      fi"
    networks:
      - app-network

networks:
  app-network:
    driver: bridge