参考文档：https://bbs.hassbian.com/thread-3105-1-1.html

https://cloud.tencent.com/developer/article/2548435

这里只介绍基于docker进行https证书自动续期的方式。
我的操作环境 ： win10， docker desktop v4.43

事前准备：

• 申请Aliyun AccessKey, 链接：https://ram.console.aliyun.com/profile/access-keys， 创建一个RAM 用户，权限添加AliyunDNSFullAccess。
  
  

1. 方式一：单独docker容器

https证书自动续期：
(使用cmd或powershell执行。 使用gitbash会报错)

# 先执行这句命令首次申请证书
docker run --rm -v ./acme.sh:/acme.sh -e Ali_Key="xxxx" -e Ali_Secret="xxxxx" neilpang/acme.sh --register-account -m xxx@example.com --issue --dns dns_ali -d yourdomain.com -d *.yourdomain.com

# 再执行这句命令，创建一个守护进程， 定时更新证书。 容器中执行crontab -l可以看到定时任务。 每60天执行一次。
# 注意这句命令挂载的目录要与上一句命令一致，以确保能够使用上面的配置
docker run --name acme.sh -d --restart unless-stopped -v ./acme.sh:/acme.sh neilpang/acme.sh daemon

以上命令会在当前执行目录下的acme.sh目录中生成目标证书， 并且会自动更新。目录内容大概是这样：

然后把这个acme.sh目录挂载到nginx容器，并修改nginx conf文件配置ssl证书即可（conf配置与方式二相同）。

2. 方式二： docker compose部署

https证书自动续期：
(使用cmd或powershell执行)

# 先执行这句命令首次申请证书
docker run --rm -v ./acme.sh:/acme.sh -e Ali_Key="xxxx" -e Ali_Secret="xxxxx" neilpang/acme.sh --register-account -m xxx@example.com --issue --dns dns_ali -d yourdomain.com -d *.yourdomain.com

在docker-compose文件中把./acme.sh目录同时挂载给nginx容器和acme容器：

docker-compose.yml中新增一个service

  web:
    image: nginx:alpine-slim
    restart: always
    ports:
      - 80:80
      - 443:443
    depends_on:
      - nextcloud
    volumes:
      # https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./acme.sh:/etc/letsencrypt                   # 证书持久化存储（关键！）
      - ./nginx/logs:/var/log/nginx
      - ./nginx/html:/usr/share/nginx/html                # 网站根目录
    networks:
      - nextcloud_default

  acme: # https证书自动续期
    # https://bbs.hassbian.com/thread-3105-1-1.html
    # https://cloud.tencent.com/developer/article/2548435
    image: neilpang/acme.sh
    restart: always
    volumes:
      - ./acme.sh:/acme.sh
    command: daemon

nginx配置文件ssl.conf中配置证书路径

server {
    listen 443 ssl;
    server_name drqf.work wwww.drqf.work;

    ssl_certificate /etc/letsencrypt/drqf.work_ecc/fullchain.cer;
    ssl_certificate_key /etc/letsencrypt/drqf.work_ecc/drqf.work.key;

    location / {
        proxy_pass http://nextcloud:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

}

附：完整的docker-compose.yml配置文件：

version: '3'

# 参考：https://github.com/nextcloud/docker

volumes:
  nextcloud:
  db:
  redis:
  onlyoffice:
  certbotwww:

networks:
  nextcloud_default:
    external: false

secrets:
  nextcloud_admin_password:
    file: ./secrets/nextcloud_admin_password.txt # put admin password in this file
  nextcloud_admin_user:
    file: ./secrets/nextcloud_admin_user.txt # put admin username in this file
  mysql_db:
    file: ./secrets/mysql_db.txt # put mysql db name in this file
  mysql_password:
    file: ./secrets/mysql_password.txt # put mysql password in this file
  mysql_user:
    file: ./secrets/mysql_user.txt # put mysql username in this file
  redis_password:
    file: ./secrets/redis_password.txt # put redis password in this file

services:
  nextcloud:
    image: nextcloud
    restart: always
    ports:
      - "8080:80"
      - "8443:443"
    volumes:
      - ./nextcloud/var/www/html/data:/var/www/html/data
      - ./nextcloud/var/www/html/config:/var/www/html/config
      - ./nextcloud/var/www/html/custom_apps:/var/www/html/custom_apps
      - ./nextcloud/home:/home
      - ./nextcloud/media:/media
    environment:
      #- NEXTCLOUD_ADMIN_USER=admin
      #- NEXTCLOUD_ADMIN_PASSWORD=admin_password
      - NEXTCLOUD_ADMIN_PASSWORD_FILE=/run/secrets/nextcloud_admin_password
      - NEXTCLOUD_ADMIN_USER_FILE=/run/secrets/nextcloud_admin_user
      - NEXTCLOUD_TRUSTED_DOMAINS=www.drqf.work
      - MYSQL_HOST=db
      #- MYSQL_PASSWORD=db_password
      #- MYSQL_DATABASE=nextcloud
      #- MYSQL_USER=db_user
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_password
      - MYSQL_DATABASE_FILE=/run/secrets/mysql_db
      - MYSQL_USER_FILE=/run/secrets/mysql_user
      #- OVERWRITEPROTOCOL=https  # 设置使用 HTTPS
      - LANG=zh_CN.UTF-8  # 设置中文语言
      #- REDIS_HOST_PASSWORD=OOhYCOxKh64UaA==
      - REDIS_HOST_PASSWORD_FILE=/run/secrets/redis_password
    depends_on:
      - db
      - redis
      - onlyoffice
    secrets:
      - nextcloud_admin_user
      - nextcloud_admin_password
      - mysql_db
      - mysql_password
      - mysql_user
      - redis_password
    networks:
      - nextcloud_default

  db:
    image: mariadb
    restart: always
    command: --transaction-isolation=READ-COMMITTED
    ports:
      - 3306:3306
    environment:
      - TZ=Asia/Shanghai
      - MYSQL_ROOT_PASSWORD=db_root_password
      #- MYSQL_DATABASE=nextcloud
      #- MYSQL_USER=db_user
      #- MYSQL_PASSWORD=db_password
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_password
      - MYSQL_DATABASE_FILE=/run/secrets/mysql_db
      - MYSQL_USER_FILE=/run/secrets/mysql_user
    volumes:
      - ./db:/var/lib/mysql
    networks:
      - nextcloud_default
    secrets:
      - mysql_db
      - mysql_password
      - mysql_user

  redis:
    image: redis
    ports:
      - 6379:6379
    container_name: redis
    volumes:
      - ./redis/data:/data:rw
      - ./redis/redis.conf:/etc/redis/redis.conf:rw
    restart: always
    networks:
      - nextcloud_default

  onlyoffice:
    image: onlyoffice/documentserver
    container_name: onlyoffice
    restart: always

    ports:
      - 9001:80
      - 9002:443
    environment:
      - JWT_ENABLED=true
      - JWT_SECRET=LFMN9GGGskppBoyyWwlln5xLFedGRBS7   #有需要可以改
      - REDIS_SERVER_HOST=redis
      - REDIS_SERVER_PORT=6379
    volumes:
      - ./onlyoffice/logs:/var/log/onlyoffice
      - ./onlyoffice/data:/var/www/onlyoffice/Data
    #  - ./onlyoffice/lib:/var/lib/onlyoffice
    #  - ./onlyoffice/db:/var/lib/postgresql
    #是否使用终端标准输入
    stdin_open: true
    #是否存在终端
    tty: true
    networks:
      - nextcloud_default

  web:
    image: nginx:alpine-slim
    restart: always
    ports:
      - 80:80
      - 81:81
      - 443:443
    depends_on:
      - nextcloud
    volumes:
      # https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html
      #- ./nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./acme.sh:/etc/letsencrypt                   # 证书持久化存储（关键！）
      - ./nginx/logs:/var/log/nginx
      - ./nginx/html:/usr/share/nginx/html                # 网站根目录
    volumes_from:
      - nextcloud
    networks:
      - nextcloud_default

  acme: # https证书自动续期
    # https://bbs.hassbian.com/thread-3105-1-1.html
    # https://cloud.tencent.com/developer/article/2548435
    image: neilpang/acme.sh
    restart: always
    volumes:
      - ./acme.sh:/acme.sh
    command: daemon