Acme and lego triggers only when dynamic file config is available

Traefik Traefik v3 (latest)
1

First a disclaimer - I belive this is a bug but my issue got closed on github with suggestion to go here instead.

What did you do?

I tried to configure a minimal Traefik setup with docker-compose and a single traefik.yml configuration. Traefik is intended to serve a single letsencrypt wildcard certificate validated via Digitaloceans DNS API for any request. Any container is to be picked up by labels and using get a hostname using a defaultRule configuration.

What did you see instead?

No connections went towards the digital ocean api nor towards letsencrypt. It seemed Traefik was not seeing the need for the certificate and the acme.json stays empty.

Moving tls configuration to a dynamic file loaded via file provider works properly.

A full example is available in my git repo:

What version of Traefik are you using?

3.2.0 (but same was replicated with different versions of 3.1.x)

What is your environment & configuration?

docker-compose on ubuntu LTS. This is the gist of the config.

..
tls:
  options:
    default:
      minVersion: VersionTLS12
  stores:
    default:
      defaultGeneratedCert:
        resolver: myresolver
        domain:
          main: "*.example.com"

providers:
  docker:
    exposedByDefault: false
    defaultRule: "Host(`{{ index .Labels \"com.docker.compose.service\" }}.example.com`)"

certificatesResolvers:
  myresolver:
    acme:
      email: john.doe@example.com
      storage: /acme.json
      dnsChallenge:
        provider: digitalocean
        resolvers:
         - "1.1.1.1:53"
         - "8.8.8.8:53"
        disablePropagationCheck:  true
2

tls is no static config root element (doc), it belongs into a dynamic config file, which needs to be loaded in static config via providers.file.

You can place the domains on entrypoints in static config (doc):

entryPoints:
  websecure:
    address: ':443'
    http:
      tls:
        options: foobar
        certResolver: leresolver
        domains:
          - main: example.com
            sans:
              - *.example.com
          - main: test.com
            sans:
              - foo.test.com
              - bar.test.com
3

Thanks, somehow I missed this. I tried placing the domains config and tls under websecure but then no calls to letsencrypt happens. (also I could not find any documentation on how to use options there, it just referes to foobar)

At least I understand now that my configuration using tls in a dynamic config file seems to be valid.