docker-compose.yml

version: '3.8'

x-certbot-common: &certbot-common
  image: coryaent/certbot:master
  secrets:
    - gandi_certbot_ini
  volumes:
    - certificates:/etc/letsencrypt/
  environment:
    CERTBOT_EMAIL: username@example.com
    CERTBOT_AUTHENTICATOR: dns-gandi
    CERTBOT_GANDI_CREDENTIALS_FILE: /run/secrets/gandi_certbot_ini
    CERTBOT_DOMAINS: "{{.Node.Hostname}}.example.com"

services:
  initialize:
    <<: *certbot-common
    command: certonly --agree-tos --staging -n
    configs:
      - source: certbot_init_ini
        target: /etc/letsencrypt/cli.ini
    deploy:
      mode: global-job

  renew:
    <<: *certbot-common
    command: renew --agree-tos --staging -n
    configs:
      - source: certbot_renew_ini
        target: /etc/letsencrypt/cli.ini
    deploy:
      mode: global
      labels:
        - "swarm.cronjob.enable=true"
        - "swarm.cronjob.schedule=43 36 20 * * *" # 08:36:43 PM
        - "swarm.cronjob.skip-running=false"
      restart_policy:
        condition: none

configs:
  certbot_init_ini:
    external: true
  certbot_renew_ini:
    external: true

secrets:
  gandi_certbot_ini:
    external: true

volumes:
  certificates:
    driver: local
    name: certificates