For the sake of HTTPS, where does one put a certificate, assuming I will do it the right way with Let’s Encrypt or similar? In the container that runs the https server (nginx) or on the host? Or both? I know precious little here. I’ve only managed to get a self signed cert working for development.
The certificate has to be available to your ingress web server that receives HTTPS requests from the internet. Otherwise, it won’t be able to establish a TLS session. In your case, that ingress seems to be nginx.
nginx doesn’t have LE integration, so you’ll have to add an ACME client like certbot to the mix. Alternatively, you can make your life a bit easier by using Caddy instead of nginx. It has LE support built in and takes care of everything automatically.
If by “host” you mean the server running the Docker containers, it rarely does more than just that. In certain scenarios, it might have to make files from one container available to another, but even that will usually happen via Docker Volumes.
This used to be true, but not anymore! Back in August, nginx (finally) added support for certificate management via ACME providers like LetsEncrypt! Here’s their post outlining the details:
As to your question where, @TheMM is right, this is dependent on your web server and how it manages certificates. Since you were able to get a self-signed certificate working, you’re already halfway there! Were you replace those certificates with ones signed by a Trusted Root Certificate Authority (be it LetsEncrypt, ZeroSSL, or somewhere else), you’d be off to the races! That said, if you were to continue to use nginx (which, let’s be honest here, it’s a fine choice that, given its more verbose config requirements is likely to teach you more about what’s going on under the hood than an “easy mode” web server like Caddy), you could look into taking advantage of the new acme_issuer config directive to request certificates. Be warned however that it only supports HTTP-01 and TLS-ALPN-01 challenge types, which means that if your web server is not publicly exposed to the internet, LetsEncrypt won’t be able complete the challenge, and you won’t get a certificate.
Oh, thanks for the update! We use nginx for all our edge routers, so this is welcome news.