How can I get certificates from two different servers at once?

[vsfomin]

How can I run acme-companion on two servers to do load balancing?
When I try to run it on the second server with the same parameters as the first one, I get an error:

[Mon Oct 14 20:35:37 UTC 2024] <My_domain>: Invalid status. Verification error details: <1st_server's_IP>: Invalid response from http://my_domain/.well-known/acme-challenge/: 404

Apparently, after getting a certificate on the first server, the request from the second server to get a certificate for the same domain fails.
How can I get certificates from two different servers at once?

[buchdag]

Hi. Could you provide a bit more information about your setup like maybe compose files or an equivalent ?

acme-companion is not really meant to work in a clustered environment with multiple replicas as those replicas won't communicate between them and each one will attempt to obtain every certificate on their respective node (but not on other nodes), which will in turn most likely result in conflicts and possibly rate limiting.

[vsfomin]

version: "3.5"

services:
  nginx-proxy:
    image: registry.example.gg/ggem/nginx-proxy/production:latest
    container_name: gg-nginx-proxy
    ports:
      - "80:80"
      - "443:443"
    environment:
      - ENABLE_IPV6=false
      - RESOLVERS=8.8.8.8
      # - DISABLE_ACCESS_LOGS=false
      # - HTTPS_METHOD=noredirect
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - certs:/etc/nginx/certs:ro
      - ./vhostd:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - logs:/var/log/nginx_logs
      - /mnt/main:/mnt/main
    restart: always

  nginx-acme-companion:
    image: nginxproxy/acme-companion
    container_name: gg-nginx-letsencrypt
    environment:
      - DEFAULT_EMAIL=example@gmail.com
      - NGINX_PROXY_CONTAINER=gg-nginx-proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - certs:/etc/nginx/certs
      - ./vhostd:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - acme:/etc/acme.sh
    restart: always

  portainer:
    image: portainer/portainer-ce:latest
    container_name: gg-portainer
    environment:
      - VIRTUAL_PORT=9000
      - VIRTUAL_HOST=portainer.example.gg
      - LETSENCRYPT_HOST=portainer.example.gg
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - portainer-data:/data
    command: -H unix:///var/run/docker.sock
    restart: unless-stopped

networks:
  default:
    name: nginx-proxy
    external: true

volumes:
  certs:
  vhostd:
  html:
  acme:
  logs:
  portainer-data:

This is compose file, which is copy to 1st and 2nd server.
All other configuration are same.

[buchdag]

I see what you want to do, the default HTTP-01 challenge can't work in this setup (I can elaborate why if you want) but the DNS-01 challenge should work and acme-companion can use it if your DNS provider is supported by acme.sh.