Certbot Cloudflare DNS Docker Container

This container is used to generate and automatically renew SSL certificates from Let's Encrypt using the Cloudflare DNS plugin. It's based off the official Certbot image with some modifications to make it more flexible and configurable.

Docker Image	Size
serversideup/certbot-dns-cloudflare

Base Image

The image is based on certbot/dns-cloudflare:latest, providing a stable and up-to-date environment for running Certbot with Cloudflare DNS authentication.

Features

Automatic SSL certificate generation and renewal using Let's Encrypt
No configs needed, this image generates the cloudflare.ini file for you
Cloudflare DNS authentication for domain validation
Customizable configuration via environment variables
Periodic certificate renewal checks
Windows support (set REPLACE_SYMLINKS to true)
Native Docker health checks to ensure the server is running

Works great for orchestrated deployments

We designed this image to work great in orchestrated deployments like Kubernetes, Docker Swarm, or even in Github Actions. Look how simple the syntax is:

  certbot:
    image: serversideup/certbot-dns-cloudflare
    volumes:
      - certbot_data:/etc/letsencrypt
    environment:
      CLOUDFLARE_API_TOKEN: "${CLOUDFLARE_API_TOKEN}"
      CERTBOT_EMAIL: "${CERTBOT_EMAIL}"
      CERTBOT_DOMAINS: "${CERTBOT_DOMAINS}"
      CERTBOT_KEY_TYPE: "rsa"

  volumes:
    certbot_data:

Environment Variables

The following environment variables can be used to customize the Certbot container:

Variable	Description	Default Value
`CERTBOT_DOMAINS`	Comma-separated list of domains for which to obtain the certificate	-
`CERTBOT_EMAIL`	Email address for Let's Encrypt notifications	-
`CERTBOT_KEY_TYPE`	Type of private key to generate	`ecdsa`
`CERTBOT_SERVER`	The ACME server URL	`https://acme-v02.api.letsencrypt.org/directory`
`CLOUDFLARE_API_TOKEN`	Cloudflare API token for DNS authentication (see below how to create one)	-
`CLOUDFLARE_CREDENTIALS_FILE`	Path to the Cloudflare credentials file.	`/cloudflare.ini`
`CLOUDFLARE_PROPAGATION_SECONDS`	Wait time (in seconds) after setting DNS TXT records before validation. Useful if DNS propagation is slow.	`10`
`DEBUG`	Enable debug mode (prints more information to the console)	`false`
`PUID`	The user ID to run certbot as	`0`
`PGID`	The group ID to run certbot as	`0`
`RENEWAL_INTERVAL`	Interval between certificate renewal checks. Set to `0` to disable renewals and only run once.	43200 seconds (12 hours)
`REPLACE_SYMLINKS`	Replaces symlinks with direct copies of the files they reference (required for Windows)	`false`

Creating a Cloudflare API Token

Warning

Treat this token like a password. It will grant access to your Cloudflare account and can be used to modify DNS records.

Go to the Cloudflare API Tokens page.
Click on "Create Token".
Click "Use template" for the "Edit Zone DNS" template.
Change the token name (optional)
Set a specific zone under "Zone Resources" (optional)
Click on "Continue to summary".
Click on "Create Token".

Usage

Pull the Docker image:

docker pull serversideup/certbot-dns-cloudflare:latest

Run the container with the required environment variables:

Caution

Make sure to replace the -v /path/to/your/certs:/etc/letsencrypt with a valid path on your host machine.

docker run \
 -e CERTBOT_DOMAINS="yourdomain.com" \
 -e CERTBOT_EMAIL="your-email@example.com" \
 -e CLOUDFLARE_API_TOKEN="your-cloudflare-api-token" \
 -v /path/to/your/certs:/etc/letsencrypt \
serversideup/certbot-dns-cloudflare:latest

Tip

For Wildcard Certificates, use the following order for the Docker instance health check: domain.name, *.domain.name

The container will automatically generate and renew the certificate.

Resources

Discord for friendly support from the community and the team.
GitHub for source code, bug reports, and project management.
Get Professional Help - Get video + screen-sharing help directly from the core contributors.

Contributing

As an open-source project, we strive for transparency and collaboration in our development process. We greatly appreciate any contributions members of our community can provide. Whether you're fixing bugs, proposing features, improving documentation, or spreading awareness - your involvement strengthens the project.

Bug Report: If you're experiencing an issue while using these images, please create an issue.
Security Report: Report critical security issues via our responsible disclosure policy.

Need help getting started? Join our Discord community and we'll help you out!

Our Sponsors

All of our software is free an open to the world. None of this can be brought to you without the financial backing of our sponsors.

Black Level Sponsors

Bronze Sponsors

No bronze sponsors yet. Become a sponsor →

Individual Supporters

About Us

We're Dan and Jay - a two person team with a passion for open source products. We created Server Side Up to help share what we learn.

Dan Pastori	Jay Rogers

Find us at:

Our products

If you appreciate this project, be sure to check out our other projects.

📚 Books

The Ultimate Guide to Building APIs & SPAs: Build web & mobile apps from the same codebase.
Building Multi-Platform Browser Extensions: Ship extensions to all browsers from the same codebase.

🛠️ Software-as-a-Service

🌍 Open Source

AmplitudeJS: Open-source HTML5 & JavaScript Web Audio Library.
Spin: Laravel Sail alternative for running Docker from development → production.
Financial Freedom: Open source alternative to Mint, YNAB, & Monarch Money.

Uh oh!

License

serversideup/docker-certbot-dns-cloudflare

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases 5

Sponsor this project

Uh oh!

Uh oh!

Contributors 6

Uh oh!

Languages