fy1128/traefik-certs-dumper repository overview

⁠traefik-certs-dumper

Dumps Let's Encrypt certificates of a specified domain to .pem and .key files which Traefik stores in acme.json.

This image uses:

• a bash script that derrivates from mailu/traefik-certdumper⁠
• ldez's traefik-certs-dumper⁠ Special thanks to them!

IMPORTANT: It's supposed to work with Traefik v2 or higher! If you want to use this certificate dumper with v1, you can simply change the image to mailu/traefik-certdumper⁠.

⁠Usage

⁠Basic setup

Mount your ACME folder into /traefik and output folder to /output. Here's an example for docker-compose:

version: '3.7'

services:
  certdumper:
    image: humenius/traefik-certs-dumper:latest
    container_name: traefik_certdumper
    volumes:
    - ./traefik/acme:/traefik:ro
    - ./output:/output:rw
    environment:
    - DOMAIN=example.org

⁠Automatic container restart

If you want to have containers restarted after dumping certificates into your output folder, you can specify their names as comma-separated value and pass them through via optional parameter -r | --restart-containers. In this case, you must pass the Docker socket (or override $DOCKER_HOST if you use a Docker socket proxy). For instance:

version: '3.7'

services:
  certdumper:
    image: humenius/traefik-certs-dumper:latest
    container_name: traefik_certdumper
    command: --restart-containers container1,container2,container3
    volumes:
    - ./traefik/acme:/traefik:ro
    - ./output:/output:rw
    - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
    - DOMAIN=example.org

⁠Change ownership of certificate and key files

If you want to change the onwership of the certificate and key files because your container runs on different permissions than root, you can specify the UID and GID as an environment variable. These environment variables are OVERRIDE_UID and OVERRIDE_GID. These can only be integers and must both be set for the override to work. For instance:

version: '3.7'

services:
  certdumper:
    image: humenius/traefik-certs-dumper:latest
    container_name: traefik_certdumper
    command: --restart-containers container1,container2,container3
    volumes:
    - ./traefik/acme:/traefik:ro
    - ./output:/output:rw
    - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
    - DOMAIN=example.org
    - OVERRIDE_UID=1000
    - OVERRIDE_GID=1000

⁠Extract multiple domains

This Docker image is able to extract multiple domains as well. Use environment variable DOMAIN and add you domains as a comma-separated list. After certificate dumping, the certificates can be found in the domains' subdirectories respectively. (/output/DOMAIN[i]/...) If you specify a single domain, the output folder remains the same as in previous versions (< v1.3 - /output).

version: '3.7'

services:
  certdumper:
    image: humenius/traefik-certs-dumper:latest
    container_name: traefik_certdumper
    volumes:
    - ./traefik/acme:/traefik:ro
    - ./output:/output:rw
    - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      DOMAIN: example.com,example.org,example.net,hello.example.in

⁠Help!

If you need help using this image, have suggestions or want to report a problem, feel free to open an issue on GitHub!