From 82c784ce6eda18c73a78fa6287ca6bb25fda92d1 Mon Sep 17 00:00:00 2001
From: ToledoEM <8144940+ToledoEM@users.noreply.github.com>
Date: Sat, 11 Jul 2026 12:14:25 +0100
Subject: [PATCH] Persist NPM Let's Encrypt certificates

---
 nginx_webserver_proxy/CHANGELOG.md | 12 +++++-------
 nginx_webserver_proxy/config.yaml  |  8 +-------
 nginx_webserver_proxy/run.sh       | 12 ++++++++++--
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/nginx_webserver_proxy/CHANGELOG.md b/nginx_webserver_proxy/CHANGELOG.md
index cd020ea1a7..d3e20f853f 100644
--- a/nginx_webserver_proxy/CHANGELOG.md
+++ b/nginx_webserver_proxy/CHANGELOG.md
@@ -1,15 +1,13 @@
-## 2.14.1 (19-06-2026)
-- Minor bugs fixed
 # Changelog
 
-## 2.14.1
+## 2.14.1-1 (11-07-2026)
+- Persist Let's Encrypt certificates across restarts by symlinking /etc/letsencrypt to /data/letsencrypt (#2828) — thanks to @crazyrokr for reporting and suggesting the fix
+
+## 2.14.1 (19-06-2026)
 - Fix startup failure on aarch64/HAos: "/usr/bin/env: 'bash': Permission denied" (#2777)
 - Add s6-overlay/env/with-contenv exec rules to AppArmor profile
 
-## 2.14.0 
-- Minor bugs fixed
-
-## 2.14.0
+## 2.14.0 (01-05-2026)
 - Initial release wrapping jc21/nginx-proxy-manager:latest
 - NPM Admin UI on port 81; HTTP on port 80; HTTPS on port 443
 - Configurable static file server via NPM's default_host nginx config
diff --git a/nginx_webserver_proxy/config.yaml b/nginx_webserver_proxy/config.yaml
index 5e6f8598b5..837fc41b74 100644
--- a/nginx_webserver_proxy/config.yaml
+++ b/nginx_webserver_proxy/config.yaml
@@ -1,14 +1,13 @@
 name: "Nginx Proxy Manager + Static Web Server"
 slug: nginx_webserver_proxy
 description: "Nginx Proxy Manager with a built-in configurable static file server. Manage reverse proxies via NPM UI on port 81 while serving files from HA storage on port 80."
-version: "2.14.1"
+version: "2.14.1-1"
 url: "https://github.com/alexbelgium/hassio-addons/tree/master/nginx_webserver_proxy"
 arch:
   - amd64
   - aarch64
 startup: services
 init: false
-
 ports:
   80/tcp: 80
   81/tcp: 81
@@ -17,24 +16,19 @@ ports_description:
   80/tcp: "HTTP (static site + NPM proxy hosts)"
   81/tcp: "NPM Admin Web UI"
   443/tcp: "HTTPS (NPM proxy hosts)"
-
 webui: "http://[HOST]:[PORT:81]"
-
 map:
   - addon_config:rw
   - share:rw
   - media:rw
-
 options:
   static_site_enabled: true
   static_site_root: "/share/www"
   static_site_prefix: "/"
   log_level: "info"
-
 schema:
   static_site_enabled: bool
   static_site_root: str
   static_site_prefix: str
   log_level: list(info|debug|warn|error)
-
 image: "ghcr.io/alexbelgium/nginx_webserver_proxy-{arch}"
diff --git a/nginx_webserver_proxy/run.sh b/nginx_webserver_proxy/run.sh
index 3742218214..62085cbe64 100755
--- a/nginx_webserver_proxy/run.sh
+++ b/nginx_webserver_proxy/run.sh
@@ -111,8 +111,16 @@ fi
 # ---------------------------------------------------------------------------
 log "static_site_root=${STATIC_ROOT} prefix=${STATIC_PREFIX} log_level=${LOG_LEVEL}"
 # NPM's prepare service requires /etc/letsencrypt to exist.
-# HA Supervisor maps the ssl volume there automatically; for other environments create it.
-mkdir -p /etc/letsencrypt
+# Symlink /etc/letsencrypt to /data/letsencrypt for persistence across restarts.
+# Supervisor persists /data as a Docker volume; /etc/letsencrypt would otherwise be ephemeral.
+if [ ! -L /etc/letsencrypt ]; then
+    if [ -d /etc/letsencrypt ] && [ "$(ls -A /etc/letsencrypt 2> /dev/null)" ]; then
+        cp -a /etc/letsencrypt/. /data/letsencrypt/ 2> /dev/null || true
+    fi
+    rm -rf /etc/letsencrypt
+    ln -sf /data/letsencrypt /etc/letsencrypt
+fi
+mkdir -p /data/letsencrypt
 
 log "Handing off to NPM: exec /init"
 exec /init