Synology DSM 7 can automatically request and renew Let’s Encrypt certificates — very convenient. The problem is that other services on the NAS, such as AdGuard Home in Docker, don’t have access to those certificates. Without anything extra, you’d have to copy them manually after every renewal.
The script#
I use a bash script that checks whether the certificates have changed, and if so, copies them to AdGuard Home’s config directory and restarts the container.
The script compares the current certificates against the previously copied
versions using cmp. Only if there’s a difference are the new files copied,
permissions set, the container restarted, and the action logged.
Finding the certificate directory#
SSH into your Synology and navigate to /usr/syno/etc/certificate/_archive/ to
find your certificate directory. Each subfolder contains certificate files; the
INFO file shows which certificate belongs to your domain.
Scheduling it#
You can schedule the script via Control Panel > Task Scheduler in DSM, or via a cron job added over SSH.
Configuring AdGuard Home#
Set AdGuard Home’s encryption settings to:
- Certificate:
/opt/adguardhome/certs/fullchain.pem - Private key:
/opt/adguardhome/certs/privkey.pem
The host’s certs directory needs to be mounted into the container at the expected path for this to work.