Powered By GitBook
SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.

Supported Architectures

Our images support multiple architectures such as x86-64, arm64 and armhf. We utilise the docker manifest for multi-platform awareness. More information is available from docker here and our announcement here.
Simply pulling should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
The architectures supported by this image are:

Application Setup

Validation and initial setup

    Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
    For http validation, port 80 on the internet side of the router should be forwarded to this container's port 80
    For dns validation, make sure to enter your credentials into the corresponding ini (or json for some plugins) file under /config/dns-conf
      Cloudflare provides free accounts for managing dns and is very easy to use with this image. Make sure that it is set up for "dns only" instead of "dns + proxy"
      Google dns plugin is meant to be used with "Google Cloud DNS", a paid enterprise product, and not for "Google Domains DNS"
    For duckdns validation, either leave the SUBDOMAINS variable empty or set it to wildcard, and set the DUCKDNSTOKEN variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie., or sub-subdomains (ie. *, but will not both at the same time. You can use our duckdns image to update your IP on
    --cap-add=NET_ADMIN is required for fail2ban to modify iptables
    If you need a dynamic dns provider, you can use the free provider where the URL will be and the SUBDOMAINS can be www,ftp,cloud with http validation, or wildcard with dns validation.
    After setup, navigate to https://yourdomain.url to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at /config/nginx/site-confs/default).
    Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under /config/log/letsencrypt to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.

Security and password protection

    The container detects changes to url and subdomains, revokes existing certs and generates new ones during start.
    Per RFC7919, the container is shipping ffdhe4096 as the dhparams.pem.
    If you'd like to password protect your sites, you can use htpasswd. Run the following command on your host to generate the htpasswd file docker exec -it swag htpasswd -c /config/nginx/.htpasswd <username>
    You can add multiple user:pass to .htpasswd. For the first user, use the above command, for others, use the above command without the -c flag, as it will force deletion of the existing .htpasswd and creation of a new one
    You can also use ldap auth for security and access control. A sample, user configurable ldap.conf is provided, and it requires the separate image linuxserver/ldap-auth to communicate with an ldap server.

Site config and reverse proxy

    The default site config resides at /config/nginx/site-confs/default. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the default file, a new default will be created on container start.
    Preset reverse proxy config files are added for popular apps. See the file under /config/nginx/proxy_confs for instructions on how to enable them. The preset confs reside in and get imported from this repo.
    If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive"; This will ask Google et al not to index and list your site. Be careful with this, as you will eventually be de-listed if you leave this line in on a site you wish to be present on search engines
    If you wish to redirect http to https, you must expose port 80

Using certs in other containers

    This container includes auto-generated pfx and private-fullchain-bundle pem certs that are needed by other apps like Emby and Znc.
      To use these certs in other containers, do either of the following:
      (Easier) Mount the container's config folder in other containers (ie. -v /path-to-le-config:/le-ssl) and in the other containers, use the cert location /le-ssl/keys/letsencrypt/
      (More secure) Mount the SWAG folder etc that resides under /config in other containers (ie. -v /path-to-le-config/etc:/le-ssl) and in the other containers, use the cert location /le-ssl/letsencrypt/live/<your.domain.url>/ (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
      These certs include:
      cert.pem, chain.pem, fullchain.pem and privkey.pem, which are generated by Certbot and used by nginx and various other apps
      privkey.pfx, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
      priv-fullchain-bundle.pem, a pem cert that bundles the private key and the fullchain, used by apps like ZNC

Using fail2ban

    This container includes fail2ban set up with 4 jails by default:
    To enable or disable other jails, modify the file /config/fail2ban/jail.local
    To modify filters and actions, instead of editing the .conf files, create .local files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. .local files will append whatever's in the .conf files (ie. nginx-http-auth.conf --> nginx-http-auth.local)
    You can check which jails are active via docker exec -it swag fail2ban-client status
    You can check the status of a specific jail via docker exec -it swag fail2ban-client status <jail name>
    You can unban an IP via docker exec -it swag fail2ban-client set <jail name> unbanip <IP>
    A list of commands can be found here:

Updating configs

    This container creates a number of configs for nginx, proxy samples, etc.
    Config updates are noted in the changelog but not automatically applied to your files.
    If you have modified a file with noted changes in the changelog:
      Keep your existing configs as is (not broken, don't fix)
      Review our repository commits and apply the new changes yourself
      Delete the modified config file with listed updates, restart the container, reapply your changes
    If you have NOT modified a file with noted changes in the changelog:
      Delete the config file with listed updates, restart the container
    Proxy sample updates are not listed in the changelog. See the changes here:
    Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
    You can check the new sample and adjust your active config as needed.

Migration from the old linuxserver/letsencrypt image

Please follow the instructions on this blog post.


To help you get started creating a container from this image you can either use docker-compose or the docker cli.
version: "2.1"
container_name: swag
- PUID=1000
- PGID=1000
- TZ=Europe/London
- URL=yourdomain.url
- SUBDOMAINS=www, #optional
- CERTPROVIDER= #optional
- DNSPLUGIN=cloudflare #optional
- PROPAGATION= #optional
- DUCKDNSTOKEN= #optional
- EMAIL= #optional
- ONLY_SUBDOMAINS=false #optional
- EXTRA_DOMAINS= #optional
- STAGING=false #optional
- /path/to/appdata/config:/config
- 443:443
- 80:80 #optional
restart: unless-stopped
docker run -d \
--name=swag \
--cap-add=NET_ADMIN \
-e PUID=1000 \
-e PGID=1000 \
-e TZ=Europe/London \
-e URL=yourdomain.url \
-e VALIDATION=http \
-e SUBDOMAINS=www, `#optional` \
-e CERTPROVIDER= `#optional` \
-e DNSPLUGIN=cloudflare `#optional` \
-e PROPAGATION= `#optional` \
-e DUCKDNSTOKEN= `#optional` \
-e EMAIL= `#optional` \
-e ONLY_SUBDOMAINS=false `#optional` \
-e EXTRA_DOMAINS= `#optional` \
-e STAGING=false `#optional` \
-e MAXMINDDB_LICENSE_KEY= `#optional` \
-p 443:443 \
-p 80:80 `#optional` \
-v /path/to/appdata/config:/config \
--restart unless-stopped \


Docker images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate <external>:<internal> respectively. For example, -p 8080:80 would expose port 80 from inside the container to be accessible from the host's IP on port 8080 outside the container.

Ports (-p)

Https port
Http port (required for http validation and http -> https redirect)

Environment Variables (-e)

for UserID - see below for explanation
for GroupID - see below for explanation
Specify a timezone to use EG Europe/London.
Top url you have control over ( if you own it, or if dynamic dns).
Certbot validation method to use, options are http, dns or duckdns (dns method also requires DNSPLUGIN variable set) (duckdns method requires DUCKDNSTOKEN variable set, and the SUBDOMAINS variable must be either empty or set to wildcard).
Subdomains you'd like the cert to cover (comma separated, no spaces) ie. www,ftp,cloud. For a wildcard cert, set this exactly to wildcard (wildcard cert is available via dns and duckdns validation only)
Optionally define the cert provider. Set to zerossl for ZeroSSL certs (requires existing ZeroSSL account and the e-mail address entered in EMAIL env var). Otherwise defaults to Let's Encrypt.
Required if VALIDATION is set to dns. Options are aliyun, cloudflare, cloudxns, cpanel, digitalocean, directadmin, dnsimple, dnsmadeeasy, domeneshop, gandi, gehirn, google, he, hetzner, inwx, ionos, linode, luadns, netcup, njalla, nsone, ovh, rfc2136, route53, sakuracloud, transip and vultr. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under /config/dns-conf.
Optionally override (in seconds) the default propagation time for the dns plugins.
Required if VALIDATION is set to duckdns. Retrieve your token from
Optional e-mail address used for cert expiration notifications (Required for ZeroSSL).
If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to true
Additional fully qualified domain names (comma separated, no spaces) ie.,,*
Set to true to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes.
Add your MaxmindDB license key to automatically download the GeoLite2-City.mmdb database. Download location is /config/geoip2db. The database is updated weekly.

Volume Mappings (-v)

All the config files including the webroot reside here.
Miscellaneous Options

Environment variables from files (Docker secrets)

You can set any environment variable from a file by using a special prepend FILE__.
As an example:
-e FILE__PASSWORD=/run/secrets/mysecretpassword
Will set the environment variable PASSWORD based on the contents of the /run/secrets/mysecretpassword file.

Umask for running applications

For all of our images we provide the ability to override the default umask settings for services started within the containers using the optional -e UMASK=022 setting. Keep in mind umask is not chmod it subtracts from permissions based on it's value it does not add. Please read up here before asking for support.

User / Group Identifiers

When using volumes (-v flags), permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user PUID and group PGID.
Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic.
In this instance PUID=1000 and PGID=1000, to find yours use id user as below:
$ id username
uid=1000(dockeruser) gid=1000(dockergroup) groups=1000(dockergroup)

Docker Mods

We publish various Docker Mods to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above.

Support Info

    Shell access whilst the container is running:
      docker exec -it swag /bin/bash
    To monitor the logs of the container in realtime:
      docker logs -f swag
    Container version number
      docker inspect -f '{{ index .Config.Labels "build_version" }}' swag
    Image version number
      docker inspect -f '{{ index .Config.Labels "build_version" }}'


    26.10.21: - Existing users should update: proxy.conf - Mitigate vulnerabilities. Ref:
    23.10.21: - Fix Hurricane Electric (HE) DNS validation.
    12.10.21: - Fix deprecated LE root cert check to fix failures when using STAGING=true, and failures in revoking.
    06.10.21: - Added support for Hurricane Electric (HE) DNS validation. Added lxml build deps.
    01.10.21: - Check if the cert uses the old LE root cert, revoke and regenerate if necessary. Here's more info on LE root cert expiration
    19.09.21: - Add an optional header to opt out of Google FLoC in ssl.conf.
    17.09.21: - Mark SUBDOMAINS var as optional.
    01.08.21: - Add support for ionos dns validation.
    15.07.21: - Fix libmaxminddb issue due to upstream change.
    07.07.21: - Rebase to alpine 3.14.
    24.06.21: - Update default nginx conf folder.
    28.05.21: - Existing users should update: authelia-server.conf - Use resolver.conf and patch for CVE-2021-32637.
    20.05.21: - Modify resolver.conf generation to detect and ignore ipv6.
    14.05.21: - Existing users should update: nginx.conf, ssl.conf, proxy.conf, and the default site-conf - Rework nginx.conf to be inline with alpine upstream and relocate lines from other files. Use wheel index for pip packages. Switch to using ffdhe4096 for dhparams.pem per RFC7919. Added worker_processes.conf, which sets the number of nginx workers, and resolver.conf, which sets the dns resolver. Both conf files are auto-generated only on first start and can be user modified later.
    21.04.21: - Existing users should update: authelia-server.conf and authelia-location.conf - Add remote name/email headers and pass http method.
    12.04.21: - Add php7-gmp and php7-pecl-mailparse.
    12.04.21: - Add support for vultr dns validation.
    14.03.21: - Add support for directadmin dns validation.
    12.02.21: - Clean up rust/cargo cache, which ballooned the image size in the last couple of builds.
    10.02.21: - Fix aliyun, domeneshop, inwx and transip dns confs for existing users.
    09.02.21: - Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years).
    26.01.21: - Add support for hetzner dns validation.
    20.01.21: - Add check for ZeroSSL EAB retrieval.
    08.01.21: - Add support for getting certs from ZeroSSL via optional CERTPROVIDER env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide donoteditthisfile.conf because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled.
    03.01.21: - Existing users should update: /config/nginx/site-confs/default - Add helper pages to aid troubleshooting
    10.12.20: - Add support for njalla dns validation
    09.12.20: - Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation.
    01.11.20: - Add support for netcup dns validation
    29.10.20: - Existing users should update: ssl.conf - Add frame-ancestors to Content-Security-Policy.
    04.10.20: - Existing users should update: nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering.
    20.09.20: - Existing users should update: nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme.
    08.09.20: - Add php7-xsl.
    01.09.20: - Existing users should update: nginx.conf, proxy.conf, and various proxy samples - Global websockets across all configs.
    03.08.20: - Initial release.
Last modified 1h ago