docker-compose.yml

version: '3'
services:
  nginx:
    image: owasp/modsecurity-crs:3.3-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    network_mode: host
    volumes:
      - ./entrypoint.sh:/entrypoint.sh
      - ./data/nginx/conf.d:/etc/nginx/conf.d
      - ./data/nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./data/nginx/exclusion-rules.conf:/opt/owasp-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
      - ./data/nginx/GeoIP:/usr/share/GeoIP/
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - ./data/certbot:/etc/letsencrypt
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & /entrypoint.sh'"
  certbot:
    image: certbot/certbot:arm32v6-latest
    restart: unless-stopped
    volumes:
      - ./data/certbot:/etc/letsencrypt
      - ./duckdns-hook.sh:/duckdns-hook.sh
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 24h & wait $${!}; done;'"