The wildcard subdomain environment variable cause issues

[imfaisalkh]

I'm using this image as following in my docker-compose.yml file:

version: "3"

services:
  # Server
  server:
    environment:
      VIRTUAL_HOST: server.example.com
      LETSENCRYPT_HOST: server.example.com

  # Dashboard
  dashboard:
    environment:
      VIRTUAL_HOST: dashboard.example.com
      LETSENCRYPT_HOST: dashboard.example.com

  # Sites
  sites:
    environment:
      VIRTUAL_HOST: *.example.com <------ THIS IS WORKING (see updated comment below)
      LETSENCRYPT_HOST: *.example.com <------ THIS IS CAUSING ISSUE

  # Root
  root:
    environment:
      VIRTUAL_HOST: example.com
      LETSENCRYPT_HOST: example.com

The reverse-proxy works fine if I don't use the wildcard subdomain under sites container. Once wildcard environment variable is included it does not work at all. Am I doing something wrong here? Although, the docs state that it is supported:

Wildcard Hosts

You can also use wildcards at the beginning and the end of host name, like .bar.com or foo.bar.. Or even a regular expression, which can be very useful in conjunction with a wildcard DNS service like xip.io, using ~^foo.bar..*.xip.io will match foo.bar.127.0.0.1.xip.io, foo.bar.10.0.2.2.xip.io and all other given IPs. More information about this topic can be found in the nginx documentation about server_names.

I want to catch all subdomains under sites container (provided that subdomain is not specifically assigned to any other container)

[imfaisalkh]

I realized the wildcard subdomain is actually working for the VIRTUAL_HOST environment variable (i.e. it is correctly catching the subdomains and redirecting it to the correct web service). However, it is not working for LETSENCRYPT_HOST environment variable (i.e. SSL certificate is not being generated for wildcard subdomains)

Is it the expected behavior? Do I need to specify each potential subdomain specifically under LETSENCRYPT_HOST variable?

[melefabrizio]

Certbot allows wildcard domain to be issued only by DNS-01 challenge, which requires some manual action or API configuration

[tkw1536]

This is a known issue with docker-letsencrypt-nginx-proxy-companion, which doesn't support wildcard certs.
See nginx-proxy/acme-companion#319.

[imfaisalkh]

This is a known issue with docker-letsencrypt-nginx-proxy-companion, which doesn't support wildcard certs.
See nginx-proxy/docker-letsencrypt-nginx-proxy-companion#319.

Yeah, I realized that therefore I'm looking for some other acme client which supports this feature.