> ## Documentation Index
> Fetch the complete documentation index at: https://docs-v2.ard.co/llms.txt
> Use this file to discover all available pages before exploring further.

# SSL Certificate Renewal

> Complete guide for renewing SSL certificates and deploying Traefik Docker images

This guide covers the complete process of renewing SSL certificates using Let's Encrypt and deploying them through Docker Traefik services.

## Prerequisites

Before starting the renewal process, ensure you have:

<CardGroup>
  <Card title="Repository Access">
    Access to the infrastructure Git repository

    **Repository:** `https://git.wthr.ws/devops/infrastructure`
  </Card>

  <Card title="SSH Access">
    SSH access configured to swarm cluster servers (check `~/.ssh/config`)
  </Card>

  <Card title="Docker Registry">
    Access to push images to the Docker registry

    **Registry:** `registry.docker.devops.arabiaweather.com`
  </Card>
</CardGroup>

## Managed Domains

The following domains are included in the SSL certificate renewal process:

```bash theme={null}
LETS_ENCRYPT_CERTS=(
  'api.mobile.devops.arabiaweather.com'
  'media.devops.arabiaweather.com'
  'meteoweather.global'
  'forum.arabiaweather.com'
  'safi-app.com'
  'ard.co'
  'internal.ard.co'
  'devops.arabiaweather.com'
  'arabiaweather.com'
)
```

## Renewal Process

<Steps>
  <Step title="Access the Infrastructure Repository">
    Clone or navigate to the infrastructure repository:

    ```bash theme={null}
    git clone https://git.wthr.ws/devops/infrastructure
    cd infrastructure
    ```

    <Note>
      If you already have the repository cloned, navigate to it and pull the latest changes.
    </Note>
  </Step>

  <Step title="Run the Renewal Script">
    Execute the `renew.sh` script to generate new certificates:

    ```bash theme={null}
    ./renew.sh
    ```

    The script will:

    * Generate new Let's Encrypt certificates for all domains in `LETS_ENCRYPT_CERTS`
    * Create a Docker Traefik image containing the updated certificates
    * Prepare the image for deployment

    <Warning>
      Ensure you have sufficient disk space and network connectivity before running the script. The process may take several minutes.
    </Warning>
  </Step>

  <Step title="Tag the Docker Image">
    After the script completes, tag the generated Traefik image with an appropriate version tag:

    ```bash theme={null}
    docker tag <generated-image> registry.docker.devops.arabiaweather.com/traefik:2025.11.01-2
    ```

    <Note>
      Replace `2025.11.01-2` with the current date and version number. The format is typically `YYYY.MM.DD-V` where V is a version number.
    </Note>
  </Step>

  <Step title="Push to Docker Registry">
    Push the tagged image to the Docker registry:

    ```bash theme={null}
    docker push registry.docker.devops.arabiaweather.com/traefik:2025.11.01-2
    ```
  </Step>

  <Step title="Connect to Swarm Cluster">
    SSH to one of the swarm cluster servers. Based on your SSH config, use:

    ```bash theme={null}
    ssh swarm-n01
    # or
    ssh swarm-n02
    # or
    ssh swarm-n03
    ```

    <Note>
      The swarm cluster servers are configured in `~/.ssh/config`:

      * `swarm-n01` → 94.130.164.122
      * `swarm-n02` → 94.130.205.92
      * `swarm-n03` → 46.4.20.188
    </Note>
  </Step>

  <Step title="Update Docker Services">
    Update both Traefik services with the new image:

    ```bash theme={null}
    docker service update --image=registry.docker.devops.arabiaweather.com/traefik:2025.11.01-2 infra-traefik_traefik_init

    docker service update --image=registry.docker.devops.arabiaweather.com/traefik:2025.11.01-2 infra-traefik_traefik
    ```

    <Warning>
      The service update will cause a brief interruption. Monitor the service status to ensure it restarts successfully.
    </Warning>
  </Step>

  <Step title="Verify Deployment">
    Verify that the services are running with the new image:

    ```bash theme={null}
    docker service ps infra-traefik_traefik_init
    docker service ps infra-traefik_traefik
    ```

    Check that the image version matches the one you deployed.
  </Step>
</Steps>

## Next Steps

After completing the Docker service updates, you need to synchronize certificates across additional platforms:

<Tabs>
  <Tab title="Bunny CDN">
    Upload certificates to multiple Bunny CDN hostnames.

    [View Bunny CDN Guide →](/infrastructure/certificate-deployment/bunny-cdn)
  </Tab>

  <Tab title="Load Balancers">
    Update certificates on Hetzner and Digital Ocean load balancers.

    [View Load Balancers Guide →](/infrastructure/certificate-deployment/load-balancers)
  </Tab>

  <Tab title="AWS3 Nodes">
    Build and deploy new nginx Docker image with updated certificates for MinIO services.

    [View AWS3 Nodes Guide →](/infrastructure/certificate-deployment/aws3-nodes)
  </Tab>

  <Tab title="Servers">
    Copy certificates to Stations and Forum servers and reload nginx.

    [View Servers Guide →](/infrastructure/certificate-deployment/servers)
  </Tab>
</Tabs>