swag

5.8.0-ls494

SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.

docker pull lscr.io/linuxserver/swag:latest

Quick start

Generated from the image's own configuration. Replace the /path/to folders with real paths on your host.

---
services:
  swag:
    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - URL=example.com
      - VALIDATION=http
      - SUBDOMAINS=www, # optional
      - CERTPROVIDER= # optional
      - CERT_PROFILE= # optional
      - DNSPLUGIN=cloudflare # optional
      - PROPAGATION= # optional
      - EMAIL= # optional
      - ONLY_SUBDOMAINS=false # optional
      - EXTRA_DOMAINS= # optional
      - STAGING=false # optional
      - DISABLE_F2B= # optional
      - SWAG_AUTORELOAD= # optional
      - SWAG_AUTORELOAD_WATCHLIST= # optional
    volumes:
      - /path/to/swag/config:/config
    ports:
      - 443:443
      - 80:80 # optional
      - 443:443/udp # optional
    restart: unless-stopped

Parameters

Ports
PortFunctionRequired
443:443HTTPS portrequired
80:80HTTP port (required for HTTP validation and HTTP -> HTTPS redirect)optional
443:443/udpQUIC (HTTP/3) port. Must be enabled in the default and proxy confs.optional
Environment variables
VariableFunctionRequired
PUID=1000User IDrequired
PGID=1000Group IDrequired
TZ=Etc/UTCTimezonerequired
URL=example.comTop url you have control over (e.g. `example.com` if you own it, or `customsubdomain.example.com` if dynamic dns).required
VALIDATION=httpCertbot validation method to use, options are `http` or `dns` (`dns` method also requires `DNSPLUGIN` variable set).required
SUBDOMAINS=www,Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` validation only)optional
CERTPROVIDER=Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt.optional
CERT_PROFILE=Optionally define a cert profile to use for cert generation. This is useful if you want to use a custom cert profile instead of the default one. Currently only supported for Let's Encrypt. See https://letsencrypt.org/docs/profiles/ optional
DNSPLUGIN=cloudflareRequired if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `hetzner-cloud`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `mijn-host`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`.optional
PROPAGATION=Optionally override (in seconds) the default propagation time for the dns plugins.optional
EMAIL=Optional e-mail address used for cert expiration notifications (Required for ZeroSSL).optional
ONLY_SUBDOMAINS=falseIf you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`optional
EXTRA_DOMAINS=Additional fully qualified domain names (comma separated, no spaces) ie. `example.net,subdomain.example.net,*.example.org`optional
STAGING=falseSet to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes.optional
DISABLE_F2B=Set to `true` to disable the Fail2ban service in the container, if you're already running it elsewhere or using a different IPS.optional
SWAG_AUTORELOAD=Set to `true` to enable automatic reloading of confs on change without stopping/restarting nginx. Your filesystem must support inotify. This functionality was previously offered [via mod](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload).optional
SWAG_AUTORELOAD_WATCHLIST=A [pipe](https://en.wikipedia.org/wiki/Vertical_bar)-separated list of additional folders for auto reload to watch in addition to `/config/nginx`optional
Volumes
PathFunctionRequired
/configPersistent config filesrequired
Other settings
SettingFunctionRequired
cap_add: NET_ADMINRequired for fail2Ban to be able to modify iptables rules.required

Architectures

Pulling :latest picks the right one for your host automatically.

  • x86_64amd64-latest
  • arm64arm64v8-latest

Tags

  • :latestStable releases

Changelog

  1. [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf, authelia-server.conf, authentik-server.conf, tinyauth-server.conf - Update Nginx configuration to replace $http_host with $host$is_request_port$request_port for better compatibility.

  2. Use new X-Tinyauth-Location header in Tinyauth locations and remove duplicate auth module headers.

  3. Rebase to Alpine 3.24 with PHP 8.5.

Writing

Posts about swag

Related

Similar images

Browse all

nginx

1.30.6-r0-ls381

nginx is an HTTP web server, reverse proxy, content cache, load balancer, TCP/UDP proxy server, and mail proxy server.

348K pulls per month162 GitHub starsarm64