EspoCRM with docker compose: switch from http to https and add SSL certificates

[tgr]

I would recommend fronting Espo with a reverse proxy that does TLS termination and takes care of renewing certificates, especially if you use an ACME-enabled certificate provider (like Let's Encrypy). It makes the TLS setup very easy. Below is part of the Composefile of my setup. I took out Espo's daemon and web socket containers to save space, they are very similar to the main Espo container. I specify environment variables per-container from the project's .env file, which adds quite many rows.

This project uses CloudFlare as the DNS provider, Let's Encrypt for TLS certificates, and the dns-01 challenge. All fully supported by Traefik's and Espo is totally oblivious of any of it. It just runs in the background. Do note that if your line of business/industry/regulations require also internal network traffic to be encrypted, this solution is not enough. But it's 95 % there.

services:

  traefik:
    image: traefik:v3.4.1
    environment:
      - TZ
      - CF_API_EMAIL
      - CF_DNS_API_TOKEN
    command:
      - "--providers.docker"
      - "--providers.docker.exposedByDefault=false"
      - "--providers.file.directory=/dynamic"
      - "--api=true"
      - "--api.dashboard=true"
      - "--ping"
      - "--accesslog=true"
      - "--log.level=INFO"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.email=$LETSENCRYPT_EMAIL"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.provider=$DNS_PROVIDER"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik:/dynamic:ro
      - traefik:/letsencrypt
    ports:
      - "80:80"
      - "443:443"
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      timeout: 30s
      interval: 30s
      retries: 5
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.rule=Host(`$DOMAIN`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.middlewares=secure-headers@file,dash-auth@file"

  db:
    image: postgres:18.0-alpine3.22
    security_opt:
      - no-new-privileges:true
    volumes:
      - postgres:/var/lib/postgresql/data:rw
      - ./db/01-init.sh:/docker-entrypoint-initdb.d/01-init.sh:r
    environment:
      - TZ
      - PGTZ
      - POSTGRES_USER
      - POSTGRES_PASSWORD
      - ESPOCRM_DATABASE_USER
      - ESPOCRM_DATABASE_PASSWORD
      - ESPOCRM_DATABASE_NAME
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -q -d $${POSTGRES_DB} -u $${POSTGRES_USER}"]
      interval: 1m30s
      timeout: 30s
      retries: 5
      start_period: 30s

  espo:
    image: espocrm/espocrm:9.1.5-apache
    volumes:
      - espo:/var/www/html
      - ./espo/custom:/var/www/html/custom
      - ./espo/application:/var/www/html/application
      - ./espo/install:/var/www/html/application/install
    environment:
      - TZ
      - ESPOCRM_TIME_ZONE
      - ESPOCRM_WEEK_START
      - ESPOCRM_DATABASE_PLATFORM
      - ESPOCRM_DATABASE_HOST
      - ESPOCRM_DATABASE_USER
      - ESPOCRM_DATABASE_PASSWORD
      - ESPOCRM_DATABASE_NAME
      - ESPOCRM_ADMIN_USERNAME
      - ESPOCRM_ADMIN_PASSWORD
      - ESPOCRM_SITE_URL
      - ESPOCRM_CONFIG_CRYPT_KEY
      - ESPOCRM_CONFIG_LOGGER_LEVEL
      - ESPOCRM_CONFIG_LOGGER_DATABASE_HANDLER
    depends_on:
      - traefik
      - db
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.espo.loadbalancer.server.port=80"
      - "traefik.http.routers.espo.rule=Host(`$DOMAIN`)"
      - "traefik.http.routers.espo.tls=true"
      - "traefik.http.routers.espo.tls.domains[0].main=$DOMAIN"
      - "traefik.http.routers.espo.tls.certresolver=letsencrypt"
      - "traefik.http.routers.espo.middlewares=secure-headers@file"

[lazovic]

Hi manoca,

Generating and renewal SSL certificates is quite convenient when using the official EspoCRM installation script with the following commands:

https://docs.espocrm.com/administration/installation-by-script/#certificate-generation

https://docs.espocrm.com/administration/installation-by-script/#certificate-renewal

It is possible to enable automatic certificate renewal:

https://docs.espocrm.com/administration/installation-by-script/#enable-automatic-certificate-renewal

[manoca]

I know this is an old post, but it describes my question 1:1
We are thinking of using this project at our company. So naturally I check out the usual blockers way ahead to avoid troubles on the way. Because of my bad experience of vaultwarden setup with my own certificcates I am wondering on how this works with this dockerized project? Yes I can use my own cert's at installation time, but is there no way to get new certs in during runtime? What if a cert expires? Could anyone here bring some light in the unknown future? I'd highly appreciate that. Thanks

[lazovic]

Hi maryanp,

For the correct operation of EspoCRM in SSL mode and in the Docker environment, I would recommend that you use the official installation script: https://docs.espocrm.com/administrat...ls-certificate.

Please keep in mind that this installation should be carried out on a clean server.

[maryanp]

Hi everyone
I've setup Espo from official docker image (via docker-compose, with MySQL)
Espo is working fine with http - http://mydomain.com:7070

I am trying to switch to secure https and add SSL certs. But it doesnt work for me
Could someone add advices or provide some short instruction how you did it.
Thanks.

My docker-compose.yml file

version: '3.8'

services:

  mysql:
    image: mysql:8
    container_name: mysql
    environment:
      MYSQL_ROOT_PASSWORD: xxxxxx
      MYSQL_DATABASE: espocrm
      MYSQL_USER: espocrm
      MYSQL_PASSWORD: xxxxxxxx
    volumes:
      - mysql:/var/lib/mysql
    restart: always

  espocrm:
    image: espocrm/espocrm
    container_name: espocrm
    environment:
      ESPOCRM_DATABASE_PLATFORM: Mysql
      ESPOCRM_DATABASE_HOST: mysql
      ESPOCRM_DATABASE_USER: espocrm
      ESPOCRM_DATABASE_PASSWORD: xxxxxxx
      ESPOCRM_ADMIN_USERNAME: admin
      ESPOCRM_ADMIN_PASSWORD: xxxxxxxx
      ESPOCRM_SITE_URL: "https://mydomain.com:7080"
    volumes:
      - espocrm:/var/www/html
      - /srv/ssl/cert.cer:/etc/ssl/certs/cert.cer
      - /srv/ssl/cert.csr:/etc/ssl/certs/cert.csr
      - /srv/ssl/cert.key:/etc/ssl/certs/private/cert.key
    restart: always
    ports:
      - 7070:80
      - 7080:443

  espocrm-daemon:
    image: espocrm/espocrm
    container_name: espocrm-daemon
    volumes:
      - espocrm:/var/www/html
    restart: always
    entrypoint: docker-daemon.sh

  espocrm-websocket:
    image: espocrm/espocrm
    container_name: espocrm-websocket
    environment:
      ESPOCRM_CONFIG_USE_WEB_SOCKET: "true"
      ESPOCRM_CONFIG_WEB_SOCKET_URL: "wss://mydomain.com:7071"
      ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBSCRIBER_DSN: "tcp://*:7777"
      ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBMISSION_DSN: "tcp://espocrm-websocket:7777"
    volumes:
      - espocrm:/var/www/html
    restart: always
    entrypoint: docker-websocket.sh
    ports:
      - 7071:7080

volumes:
  mysql:
  espocrm:​

Running Containers:



ports.conf



000-default.conf




default-ssl.conf