skills.rest
ZHLX2005
ZHLX2005COMMUNITY
Explore all skills by this author →
GitHub

https

Deploy static sites with Docker Compose, Nginx, and Let's Encrypt wildcard certificates via DNS-01.

3|1|Updated Apr 14, 2026
Search Tags:#docker compose#nginx#dns-01#static site deployment#let's encrypt#acme.sh#wildcard certificate
One-click install
npx skills add https://github.com/ZHLX2005/sl --skill https-zhlx2005
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: https
Source: https://github.com/ZHLX2005/sl/tree/main/skills/https
Command: npx skills add https://github.com/ZHLX2005/sl --skill https-zhlx2005

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Setting up HTTPS for a static site involves many fragile steps: writing docker-compose and nginx configs, issuing wildcard certificates, scripting deployments and rollbacks, and diagnosing failures like ICP firewall blocks, 403 errors on port 80, stale chunk files, and silent certificate renewal failures. This Skill provides a complete, staged workflow with reference docs for each phase. ## Core Features & Use Cases - Skeleton Configuration: Canonical /srv/web-docker directory layout, docker-compose.yml with nginx and cert mounts, and a full nginx site.conf with HSTS, SPA try_files, and cache-control rules. - Certificate Issuance: acme.sh DNS-01 flow with staging dry-run, minimum-privilege DNS credentials (Aliyun, Cloudflare, DNSPod), --install-cert with reload hooks, and cron renewal rehearsal. - Deploy & Rollback Scripts: Version-snapshot deploy.sh with rsync --delete, nginx -t validation, smoke tests, and N-version retention, plus a rollback.sh for instant reverts. - Pitfall Library: 30 curated pitfalls covering cert and deploy failures, a DNS-01 vs HTTP-01 decision tree, and mainland China ICP-blocking remediation paths. - Use Case: You need to host a frontend build on a cloud server with a wildcard cert. Follow stages A-F to survey DNS, scaffold configs, issue certificates, go live on HTTPS, and set up repeatable deployments. ## Quick Start Ask the assistant to deploy your static site with Docker Compose, Nginx, and a Let's Encrypt wildcard certificate using DNS-01, starting from the skeleton configuration reference.

Frequently Asked Questions about https

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I issue a Let's Encrypt wildcard certificate with acme.sh?▼

Use acme.sh with a DNS-01 plugin such as dns_ali, dns_cf, or dns_dp, passing both the bare domain and wildcard with two -d flags. Run a --staging dry-run first, then issue with --keylength ec-256 and install the cert to a fixed path with --install-cert and a --reloadcmd hook.

DNS-01 vs HTTP-01: which challenge should I use for Let's Encrypt?▼

DNS-01 is the recommended default because it only needs outbound API access to your DNS provider and is the only method that supports wildcard certificates. HTTP-01 requires inbound access on port 80, which fails behind firewalls, CDNs, or mainland China ICP blocking.

Why does Let's Encrypt return 403 even though my server responds on port 80?▼

On mainland China cloud servers, unregistered domains get their port 80 traffic intercepted by the provider gateway, which injects a 403 before the request reaches nginx. Switch to DNS-01 validation, which does not depend on inbound port access.

Why does my site still serve the old certificate after renewal?▼

This happens when nginx references acme.sh internal paths or when --install-cert was run without a --reloadcmd hook. Install the cert to a fixed path with a reload command like docker exec nginx nginx -s reload, then verify with acme.sh --cron --force.

How do I deploy a static site without leaving stale chunk files?▼

Sync each release into the webroot with rsync -a --delete so outdated hashed assets are removed, and keep index.html on a no-store cache header. The deploy script also validates with nginx -t before reloading and smoke-tests the site over HTTPS.

Can I use a non-standard port to bypass ICP blocking for certificate issuance?▼

No. HTTP-01 is fixed to port 80 and TLS-ALPN-01 to port 443 at the protocol level, so non-standard ports cannot be used for issuance. DNS-01 is the only challenge type that works without any inbound port access.

Related Skills

Explore More Software Engineering Skills→
gotempshgotempsh
620

temps-platform-setup

Automate installation and initial configuration of a self-hosted Temps platform.

Official
Advanced
PerryB-GITPerryB-GIT

monitoring-sites

Monitor website health, uptime, SSL certificates, and performance via bash scripts.

Community
Intermediate
mfcollins3mfcollins3

azure-firewall-manager

Configure and optimize Azure Firewall Manager deployments across virtual hubs and VNets.

Community
Advanced
Nerfherder16Nerfherder16

homelab-deploy

Publishes homelab services via VPS nginx reverse proxy and CasaOS tunnel.

Community
Advanced