Need help with dual container. Issue with LetsEncrypt for a few days now

Support Self-hosting
, ,
3

Yes, it is, because I was told to use a “bandaid” related to nginx. I can’t really explain what it is, because I don’t understand it.
But the issue is that if I then want to do a normal rebuild, I will have issues (at least, from what I was told now, if I do it before Aug 29 when, hopefully, the certificate will be reissued. At this point, I can’t truly trust any of that.

Yes, www is already there from when I first installed Discourse last year.

Now, after I pushed Claude to the limit to help me understand what’s happening, here’s what I got, and feel free to challenge that, because I’m here to learn when possible:

  • ECC, which seems to be the issue now, isn’t truly necessary, because RSA is the default and everyone will still access my website without issues, if I drop ECC completely.
  • As I said, hopefully, on Aug 29, this whole issue will be gone, once the 168h resets and the 5 cert limit is also reset:
sudo docker exec web_only grep -i "retry after" /shared/letsencrypt/acme.sh.log | tail -1
  "detail": "too many certificates (5) already issued for this exact set of identifiers in the last 168h0m0s, retry after 2026-08-29 03:43:15 UTC: see https://letsencrypt.org/docs/rate-limits/#new-certificates-per-exact-set-of-identifiers",
  • If on Aug 29 things don’t go back to normal, Claude is recommending dropping ECC. This is what it said when I asked which file would be modified and which section:

File: the copy we’re about to make, web.letsencrypt.rsa-only.template.yml (leaving your original stock file untouched as a fallback).

What gets removed inside it: this whole block, found in the /usr/local/bin/letsencrypt section of the file:

########################################################
# ECDSA cert
########################################################
issue_cert "ec-256"

if ! cert_exists "_ecc"; then
  # Try to issue the cert again if something goes wrong
  issue_cert "ec-256" "--force"
fi

LE_WORKING_DIR="${LETSENCRYPT_DIR}" ${LETSENCRYPT_DIR}/acme.sh \
  --installcert --ecc \
  -d ${DISCOURSE_HOSTNAME} \
  --fullchainpath /shared/ssl/${DISCOURSE_HOSTNAME}_ecc.cer \
  --keypath /shared/ssl/${DISCOURSE_HOSTNAME}_ecc.key \
  --reloadcmd "sv reload nginx"

That’s the entire ECC section, nothing else in the file changes. The RSA section right above it stays exactly as-is.

One more file gets touched after that: containers/web_only.yml, to point at this new copy instead of the stock template. We’ll do that as a separate, later step.