How to restart host nginx from inside docker after certbot renew - docker

Question

If you have a docker container running certbot, but a nginx instance usign those certificates running on the host, how do you restart the host nginx from inside the docker container?
This is the running container
certbot:
image: certbot/dns-ovh
container_name: certbot
volumes:
- /etc/letsencrypt/:/etc/letsencrypt
- /var/lib/letsencrypt:/var/lib/letsencrypt
- /root/.secrets/certbot-ovh.ini:/root/.secrets/ovh-creds.ini
entrypoint: /bin/sh -c 'trap exit TERM; while :; do certbot renew sleep 12h & wait $${!}; done;'

Answer 1

You have to add a --post-hook to the renew command, which uses ssh to send the nginx reload command to the host.
For this to work, the container needs to be run with network_mode: "host"
then you need to isntall sshpass and openssh when starting/recreating the container. this is done with
apk add openssh sshpass
then in the post-hook you need to ssh into the host and reload nginx
sshpass -p 'your password' ssh -o 'StrictHostKeyChecking no' root#localhost 'systemctl reload nginx'
assuming you have root access. This uses sshpass to enter the password in ssh which skips the "do you want to add the fingerprint" message and sends the relaod command to localhost
putting this all into the docker-compose file looks like this:
certbot:
image: certbot/dns-ovh
container_name: certbot
network_mode: "host"
volumes:
- /etc/letsencrypt/:/etc/letsencrypt
- /var/lib/letsencrypt:/var/lib/letsencrypt
- /root/.secrets/certbot-ovh.ini:/root/.secrets/ovh-creds.ini
entrypoint: >
/bin/sh -c
'apk add openssh sshpass &&
trap exit TERM; while :;
do certbot renew --post-hook
"sshpass -p '"'"'your password'"'"' ssh -o '"'"'StrictHostKeyChecking no'"'"' root#localhost '"'"'systemctl reload nginx'"'"'";
sleep 12h & wait $${!}; done;'
the > here allows for writing as many indented lines as i want, without needing to add anotehr layer of escaping. it also combines the lines into one line later.
the '"'"' used here is used to escape the singe ' inside the --post-hook quotes, it closes the first single quote, opens a new double quote which contains a single quote, and then opens the single quote again.