Installing Cloudflare edge certificates on a Droplet with dockerised Nginx

Hey!

One quick option here would be to setup an Nginx service on the Droplet itself and use Let’s encrypt with certbot for the SSL management:

https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04

Then in the Nginx config you can setup a reverse proxy rule to forward the traffic from the Nginx service running on the Droplet on port 443 to the docker container itself.

Alternatively, as you mentioned, setting up Cloudflare edge certificates on a Dockerized Nginx instance running on a Droplet would require a few key steps.

First, you need to have your Cloudflare SSL certificates ready. These usually include:

• A .pem file for the certificate itself
• A .key file for the private key

If you have chosen to use the free Universal SSL certificate from Cloudflare, you should have these files. If you opt for a dedicated certificate or one purchased from a third party, ensure you have the corresponding files.

After that, you need to modify your Docker configuration to include these certificates and ensure Nginx uses them. Here’s how you can do it:

Step A: Create a Directory for Certificates

On your Droplet, create a directory to store your SSL certificates. This directory will be mounted to the Docker container.

mkdir -p /etc/nginx/certs
cp path_to_your_certificate.pem /etc/nginx/certs/
cp path_to_your_private_key.key /etc/nginx/certs/

Step B: Update Nginx Configuration

Modify your Nginx configuration file to use the SSL certificates. You can create a new configuration file or edit an existing one.

server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_certificate /etc/nginx/certs/your_certificate.pem;
    ssl_certificate_key /etc/nginx/certs/your_private_key.key;

    location / {
        proxy_pass http://your_application;
    }
    # The rest of your Nginx configuration
}

Make sure to replace yourdomain.com, your_certificate.pem, and your_private_key.key with the actual names.

Step C: Update Dockerfile or Docker Compose File

To make the certificates available inside the container, you need to mount the directory you created into the Docker container. Here’s an example modification for a Docker Compose file:

services:
  nginx:
    image: nginx:latest
    ports:
      - "443:443"
    volumes:
      - /etc/nginx/certs:/etc/nginx/certs
      - ./path_to_your_nginx_conf:/etc/nginx/conf.d/default.conf
    depends_on:
      - app

Once your Docker container is running with the new configuration, you might need to reload Nginx to apply the changes without stopping the container:

docker exec -it <nginx-container-id> nginx -s reload

Next, make sure your DNS settings in Cloudflare are set to proxy through Cloudflare. This setting is indicated by an orange cloud icon in your DNS settings. This setup will encrypt the traffic between Cloudflare and your Nginx server using the SSL certificate you installed.

Finally, test your setup to ensure that everything is configured correctly. You can use tools like curl or visit your domain in a browser to check the SSL certificate details.

curl -Iv https://yourdomain.com

Let me know if you have any questions!

Best,

Bobby