$ docker secret create site.conf site.conf
```
```console
$ docker secret ls
ID NAME CREATED UPDATED
2hvoi9mnnaof7olr3z5g3g7fp site.key 58 seconds ago 58 seconds ago
aya1dh363719pkiuoldpter4b site.crt 24 seconds ago 24 seconds ago
zoa5df26f7vpcoz42qf2csth8 site.conf 11 seconds ago 11 seconds ago
```
3. Create a service that runs Nginx and has access to the three secrets. The
last part of the `docker service create` command creates a symbolic link
from the location of the `site.conf` secret to `/etc/nginx.conf.d/`, where
Nginx looks for extra configuration files. This step happens before Nginx
actually starts, so you don't need to rebuild your image if you change the
Nginx configuration.
> [!NOTE]
>
> Normally you would create a Dockerfile which copies the `site.conf`
> into place, build the image, and run a container using your custom image.
> This example does not require a custom image. It puts the `site.conf`
> into place and runs the container all in one step.
Secrets are located within the `/run/secrets/` directory in the container
by default, which may require extra steps in the container to make the
secret available in a different path. The example below creates a symbolic
link to the true location of the `site.conf` file so that Nginx can read it:
```console
$ docker service create \
--name nginx \
--secret site.key \
--secret site.crt \
--secret site.conf \
--publish published=3000,target=443 \
nginx:latest \
sh -c "ln -s /run/secrets/site.conf /etc/nginx/conf.d/site.conf && exec nginx -g 'daemon off;'"
```
Instead of creating symlinks, secrets allow you to specify a custom location
using the `target` option. The example below illustrates how the `site.conf`
secret is made available at `/etc/nginx/conf.d/site.conf` inside the container
without the use of symbolic links:
```console
$ docker service create \
--name nginx \
--secret site.key \
--secret site.crt \
--secret source=site.conf,target=/etc/nginx/conf.d/site.conf \
--publish published=3000,target=443 \
nginx:latest \
sh -c "exec nginx -g 'daemon off;'"
```
The `site.key` and `site.crt` secrets use the short-hand syntax, without a
custom `target` location set. The short syntax mounts the secrets in `/run/secrets/
with the same name as the secret. Within the running containers, the following
three files now exist:
- `/run/secrets/site.key`
- `/run/secrets/site.crt`
- `/etc/nginx/conf.d/site.conf`
4. Verify that the Nginx service is running.
```console
$ docker service ls
ID NAME MODE REPLICAS IMAGE
zeskcec62q24 nginx replicated 1/1 nginx:latest
$ docker service ps nginx
NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS
nginx.1.9ls3yo9ugcls nginx:latest moby Running Running 3 minutes ago
```
5. Verify that the service is operational: you can reach the Nginx
server, and that the correct TLS certificate is being used.
```console
$ curl --cacert root-ca.crt https://localhost:3000
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support. refer to
<a href="https://nginx.org">nginx.org</a>.<br/>
Commercial support is available at
<a href="https://www.nginx.com">nginx.com</a>.</p>