nginx container cannot see the certificate in shared certbot volume

So i have certbot run as a container and create a normal and wildcard certificate with the following command

 sudo docker run -it --rm --name certbot -v certbot_certs:/etc/letsencrypt -v /var/www/certbot:/var/www/certbot -v ~/.secrets/certbot:/.secrets/certbot certbot/dns-digitalocean certonly --dns-digitalocean --dns-digitalocean-credentials /.secrets/certbot/do.ini --server https://acme-v02.api.letsencrypt.org/directory --email xxxxxxxxxxxxxxxxxxxx --agree-tos --no-eff-email -d <domain> -d *.<domain>

the operation is successful as shown in the terminal result

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/<domain>/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/<domain>/privkey.pem
This certificate expires on 2023-10-08.
These files will be updated when the certificate renews.

my docker-compose.ylm has this declared in the config of the nginx container

      volumes:
        - certbot_certs:/etc/nginx/ssl:ro
        - /var/www/certbot:/var/www/certbot:ro

and the nginx.conf contains

server {
    listen 443 ssl http2;

    
    server_name geokotze.dev www.geokotze.dev;

    ssl_certificate /etc/nginx/ssl/live/<domain>/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/live/<domain>/privkey.pem;
    
    location / {
        root /usr/share/nginx/html;
        index index.html;
    }
}

a check of the certbot_certs volume tree shows the certificates under /live/<domain>/

so from what i understand this should work.

And yet i get the error

[emerg] 1#1: cannot load certificate "/etc/nginx/ssl/live/<domain>/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/nginx/ssl/live/<domain>/fullchain.pem, r) error:10000080:BIO routines::no such file)

I am too dumb and tired (currently working 10 hour kitchen shifts trying to become a dev) to keep trying to figure this out on my own. Before i tried to run it with compose it worked so i am sure i fucked something in the compose.yml but i cant't figure out what.

Help me fellow nerds. Please.

Also any tips are valued and would not be taken as condescending.

<3

I was expecting it to work and if i spend more time troubleshooting instead of sleeping the chef will add me to the sauce

If you've worked with docker-compose, you are probably familiar with the fact that service names in your docker-compose.yaml are modified (by adding a project prefix and an instance number) to form container names. That is, if I have the following docker-compose.yaml in a directory named example:

services:
    web:
      image: alpinelinux/darkhttpd

Then I end up with:

$ docker ps --format='{{ .Names }}'
example-web-1

The same thing happens for volumes. If I have:

services:
    web:
      image: alpinelinux/darkhttpd
      volumes:
        - certbot_certs:/etc/nginx/ssl

volumes:
  certbot_certs:

Then I end up with:

$ docker volume ls
DRIVER    VOLUME NAME
local     example_certbot_certs

In other words, the certbot_certs volume in your docker-compose.yaml file is not the same as the volume you created with your docker run command line.

If you want your compose stack to refer to an existing volume, you need to mark the volume as external, like this:

services:
    web:
      image: alpinelinux/darkhttpd
      volumes:
        - certbot_certs:/etc/nginx/ssl

volumes:
  certbot_certs:
    external: true