docker-compose.yml first stack (central one, 1 per server):
version: '3.6'
networks:
web:
external: true
internal:
external:
name: traefik-proxy
volumes:
# Volume to store traefik certificates
traefik-letsencrypt:
services:
# Skipping the other containers / central monitoring (1 / server)
traefik:
image: "traefik:v2.6"
container_name: "traefik"
command:
- "--log.level=DEBUG"
# http://ud2.REDACTED.com:8080/dashboard/#/
- "--api.dashboard=true"
- "--api.insecure=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--providers.docker.endpoint=unix:///var/run/docker.sock"
- "--providers.docker.network=traefik-proxy"
# Redirect http to https
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
- "--entrypoints.web.http.redirections.entrypoint.permanent=true"
# Https : port 443, with letsencrypt certificates
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.myresolver.acme.httpchallenge=true"
- "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
# staging letsencrypt (no quotas, but self signed certificates), comment to move to prod
#- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.myresolver.acme.email=postmaster@${DOMAIN}"
- "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
# Expose prometheus metrics : KO - not working
# logs :
# level=error msg="entryPoint \"metrics\" doesn't exist" routerName=prometheus@internal entryPointName=metrics
# level=error msg="no valid entryPoint for this router" routerName=prometheus@internal
- "--metrics.prometheus=true"
- '--metrics.prometheus.buckets=0.1,0.3,1.2,5.0'
#- "--metrics.prometheus.entrypoint=metrics"
#- "--accesslog=true"
#- "--tracing=true"
ports:
- "80:80"
- "443:443"
- "8080:8080"
volumes:
- traefik-letsencrypt:/letsencrypt
- "/var/run/docker.sock:/var/run/docker.sock:ro"
networks:
#- web
- internal
Then I am running (potentially multiple times), thus the variables, and thus the other docker-compose.yml file since I instanciate it from different directories with different values setting the variables in different..env files 
version: "3.6"
networks:
database: {}
node: {}
frontend:
external:
name: traefik-proxy
services:
#whoami works ok
whoami:
image: "traefik/whoami"
container_name: "whoami"
networks:
- frontend
labels:
- traefik.enable=true
- traefik.docker.network=traefik-proxy
- traefik.http.routers.whoami.rule=Host(`whoami.ud2.REDACTED.com`)
- traefik.http.routers.whoami.entrypoints=websecure
- traefik.http.routers.whoami.tls.certresolver=myresolver
- traefik.http.services.whoami.loadbalancer.server.port=80
#this one is KO (502 BAD Gateway)
mezos:
image: ${mezos_docker_image}
# entrypoint: ./mezos.exe
command: run --chain-db="${DBURL}" --tezos-url=http://node:${node_port_rpc} --mezos-url="http://mezos:${mezos_port_rpc}" --more-logs --verbosity=debug
env_file:
./.env
environment:
PROTO: ${MEZOS_PROTO:-11}
depends_on:
postgres:
condition: service_healthy
node:
condition: service_healthy
indexer-token-support:
condition: service_started
indexer-mempool:
condition: service_started
restart: always
healthcheck:
test: ["CMD", "wget", "--tries=1", "--spider", "http://mezos:${mezos_port_rpc}/version"]
interval: 10s
timeout: 5s
hostname: ${specific}-mezos
ports:
- ${mezos_port_rpc}:${mezos_port_rpc}
expose:
- ${mezos_port_rpc}
networks:
- frontend
- node
- database
labels:
- traefik.enable=true
- traefik.docker.network=traefik-proxy
- traefik.http.routers.${specific_net}-mezos.rule=Host(`${specific_net}.ud2.REDACTED.com`)
- traefik.http.routers.${specific_net}-mezos.entrypoints=websecure
- traefik.http.routers.${specific_net}-mezos.tls.certresolver=myresolver
- traefik.http.services.${specific_net}-mezos.loadbalancer.server.port=29091
-
whoami.ud2.REDACTED.com
- .ud2.REDACTED.com
with the message 502 Bad Gatewaywhatever I've tried so far, but weirdly it answers correctly on http://ud2.REDACTED.com:29091
Extended (redacted) traefik logs for the request resulting in 502 error
traefik | 2022-03-17T01:29:09.911990360Z time="2022-03-17T01:29:09Z" level=debug msg="vulcand/oxy/roundrobin/rr: Forwarding this request to URL" Request="{\"Method\":\"GET\",\"URL\":{\"Scheme\":\"\",\"Opaque\":\"\",\"User\":null,\"Host\":\"\",\"Path\":\"/version\",\"RawPath\":\"\",\"ForceQuery\":false,\"RawQuery\":\"\",\"Fragment\":\"\",\"RawFragment\":\"\"},\"Proto\":\"HTTP/2.0\",\"ProtoMajor\":2,\"ProtoMinor\":0,\"Header\":{\"Accept\":[\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\"],\"Accept-Encoding\":[\"gzip, deflate, br\"],\"Accept-Language\":[\"en-US,en;q=0.7,fr;q=0.3\"],\"Cache-Control\":[\"max-age=0\"],\"Cookie\":[\"ph_mqkwGT0JNFqO-zX2t0mW6Tec9yooaVu7xCBlXtHnt5Y_posthog=%7B%22distinct_id%22%3A%2217f760123c286c-055091e71de439-455a69-7e9000-17f760123c311b1%22%2C%22%24device_id%22%3A%2217f760123c286c-055091e71de439-455a69-7e9000-17f760123c311b1%22%7D\"],\"Dnt\":[\"1\"],\"Sec-Fetch-Dest\":[\"document\"],\"Sec-Fetch-Mode\":[\"navigate\"],\"Sec-Fetch-Site\":[\"none\"],\"Sec-Fetch-User\":[\"?1\"],\"Sec-Gpc\":[\"1\"],\"Te\":[\"trailers\"],\"Upgrade-Insecure-Requests\":[\"1\"],\"User-Agent\":[\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:98.0) Gecko/20100101 Firefox/98.0\"],\"X-Forwarded-Host\":[\"specific.ud2.REDACTED.com\"],\"X-Forwarded-Port\":[\"443\"],\"X-Forwarded-Proto\":[\"https\"],\"X-Forwarded-Server\":[\"30e4173f9b1e\"],\"X-Real-Ip\":[\"<MY_IP>\"]},\"ContentLength\":0,\"TransferEncoding\":null,\"Host\":\"specific.ud2.REDACTED.com\",\"Form\":null,\"PostForm\":null,\"MultipartForm\":null,\"Trailer\":null,\"RemoteAddr\":\"<MY_IP>:61925\",\"RequestURI\":\"/version\",\"TLS\":null}" ForwardURL="http://172.30.0.8:29091"
traefik | 2022-03-17T01:29:09.912135753Z time="2022-03-17T01:29:09Z" level=debug msg="'502 Bad Gateway' caused by: dial tcp 172.30.0.8:29091: connect: connection refused"
traefik | 2022-03-17T01:29:09.912231383Z time="2022-03-17T01:29:09Z" level=debug msg="vulcand/oxy/roundrobin/rr: completed ServeHttp on request" Request="{\"Method\":\"GET\",\"URL\":{\"Scheme\":\"\",\"Opaque\":\"\",\"User\":null,\"Host\":\"\",\"Path\":\"/version\",\"RawPath\":\"\",\"ForceQuery\":false,\"RawQuery\":\"\",\"Fragment\":\"\",\"RawFragment\":\"\"},\"Proto\":\"HTTP/2.0\",\"ProtoMajor\":2,\"ProtoMinor\":0,\"Header\":{\"Accept\":[\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\"],\"Accept-Encoding\":[\"gzip, deflate, br\"],\"Accept-Language\":[\"en-US,en;q=0.7,fr;q=0.3\"],\"Cache-Control\":[\"max-age=0\"],\"Cookie\":[\"ph_mqkwGT0JNFqO-zX2t0mW6Tec9yooaVu7xCBlXtHnt5Y_posthog=%7B%22distinct_id%22%3A%2217f760123c286c-055091e71de439-455a69-7e9000-17f760123c311b1%22%2C%22%24device_id%22%3A%2217f760123c286c-055091e71de439-455a69-7e9000-17f760123c311b1%22%7D\"],\"Dnt\":[\"1\"],\"Sec-Fetch-Dest\":[\"document\"],\"Sec-Fetch-Mode\":[\"navigate\"],\"Sec-Fetch-Site\":[\"none\"],\"Sec-Fetch-User\":[\"?1\"],\"Sec-Gpc\":[\"1\"],\"Te\":[\"trailers\"],\"Upgrade-Insecure-Requests\":[\"1\"],\"User-Agent\":[\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:98.0) Gecko/20100101 Firefox/98.0\"],\"X-Forwarded-Host\":[\"specific.ud2.REDACTED.com\"],\"X-Forwarded-Port\":[\"443\"],\"X-Forwarded-Proto\":[\"https\"],\"X-Forwarded-Server\":[\"30e4173f9b1e\"],\"X-Real-Ip\":[\"<MY_IP>\"]},\"ContentLength\":0,\"TransferEncoding\":null,\"Host\":\"specific.ud2.REDACTED.com\",\"Form\":null,\"PostForm\":null,\"MultipartForm\":null,\"Trailer\":null,\"RemoteAddr\":\"<MY_IP>:61925\",\"RequestURI\":\"/version\",\"TLS\":null}"
I've found this : 502 Bad Gateway connection refused error - #9 by jcisio but it didn't help 
Thanks in advance for any tips on how to fix / refactor all this !