Hi all,
I currently have the setup OPNsense redirecting all DNS queries over port 53 to AdGuard which has Unbound DNS (on OPNsense) as the DNS upstream, and ports 80 & 443 forwarded to my VM running Docker.
I previously had an internal domain that I manually created SSL certificates for, and issued them but I am wanting to use my external domain and have Traefik issue the SSL certificates. I previously had this setup before using OPNsense, and had no issues.
Now when I am trying to pull down the certificate, I am getting the following error
acme: cleaning up failed: cloudflare: could not find the start of authority for _acme-challenge.ragenetwork.me.: read udp 10.80.0.2:56467->1.0.0.1:53: i/o timeout
acme: error presenting token: cloudflare: could not find the start of authority for _acme-challenge.ragenetwork.me.: read udp 10.80.0.2:60737->1.0.0.1:53: i/o timeout
Inside the acme.json file I can see the ACME account etc, but under Certificates it just says "null".
If I try to visit the traefik dashboard, I can login and the certificate in the browser says its a Cloudflare certificate, but if I comment out the acme-staging command, I then get Invalid SSL errors when trying to visit other subdomains.
I have tested the DNS inside the docker container and resolves with no issues, as well as DNS on the Ubuntu server. I do have firewall rules that redirects DNS queries to my AdGuard instance running on OPNsense, and also firewall rules that block any DNS queries that try to circumvent the above. I have tried disabling the block rule, which still gives me the same error. I can see the DNS queries show up in the AdGuard log, so I am kinda stumped at what I am missing here.
Any help would be greatly appreciated!
Docker-Compose for Traefik
# Traefik - Reverse Proxy
traefik:
<<: *common-keys-core
image: traefik:2.7
container_name: traefik
hostname: traefik
ports:
- target: 80
published: 80
protocol: tcp
mode: host
- target: 443
published: 443
protocol: tcp
mode: host
networks:
traefik:
ipv4_address: 10.80.0.2
# dns:
# - "10.20.0.1" #internal DNS ip
# dns_search: ragenetwork.lan #namespace used in internal DNS
volumes:
- $DOCKERDIR/traefik/rules:/rules
- $DOCKERDIR/traefik/acme/acme.json:/acme.json
- /home/docker/logs:/logs
- /var/run/docker.sock:/var/run/docker.sock:ro
- /etc/localtime:/etc/localtime:ro
environment:
- TZ=$TZ
- CF_API_EMAIL_FILE=/run/secrets/cf_email
- CF_API_KEY_FILE=/run/secrets/cf_api_key
- HTPASSWD_FILE=/run/secrets/htpasswd
- DOMAINNAME
secrets:
- cf_email
- cf_api_key
- htpasswd
command: # CLI arguments
- --global.checkNewVersion=true
- --global.sendAnonymousUsage=false
- --entryPoints.http.address=:80
- --entryPoints.https.address=:443
# Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/
- --entrypoints.https.forwardedHeaders.trustedIPs=$CF_IPS,$LOCAL_IPS
- --entryPoints.traefik.address=:8080
- --api=true
# - --api.insecure=true
- --api.dashboard=true
# - --serversTransport.insecureSkipVerify=true
- --log=true
- --log.filePath=/logs/traefik.log
- --log.level=DEBUG # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
- --accessLog=true
- --accessLog.filePath=/logs/access.log
- --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
- --accessLog.filters.statusCodes=204-299,400-499,500-599
- --providers.docker=true
- --providers.docker.endpoint=unix:///var/run/docker.sock
- --providers.docker.exposedByDefault=false
- --entrypoints.https.http.tls.options=tls-opts@file
# Add dns-cloudflare as default certresolver for all services. Also enables TLS and no need to specify on individual services
- --entrypoints.https.http.tls.certresolver=dns-cloudflare
- --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME
- --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME
- --providers.docker.network=traefik
- --providers.docker.swarmMode=false
- --providers.file.directory=/rules
# - --providers.file.filename=/path/to/file
- --providers.file.watch=true # Only works on top level files in the rules folder
- --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing
- --certificatesResolvers.dns-cloudflare.acme.email=$CLOUDFLARE_EMAIL
- --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json
- --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare
- --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53
- --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.delayBeforeCheck=100 # To delay DNS check and reduce LE hitrate
labels:
#- "autoheal=true"
- "traefik.enable=true"
# HTTP-to-HTTPS Redirect
- "traefik.http.routers.http-catchall.entrypoints=http"
- "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
- "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
# HTTP Routers
- "traefik.http.routers.traefik-rtr.entrypoints=https"
- "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME`)"
- "traefik.http.routers.traefik-rtr.tls=true" # Some people had 404s without this
- "traefik.http.routers.traefik-rtr.tls.certresolver=dns-cloudflare"
- "traefik.http.routers.traefik-rtr.tls.domains[0].main=$DOMAINNAME"
- "traefik.http.routers.traefik-rtr.tls.domains[0].sans=*.$DOMAINNAME"
## Services - API
- "traefik.http.routers.traefik-rtr.service=api@internal"
## Middlewares
# - "traefik.http.routers.traefik-rtr.middlewares=chain-no-auth@file" # For No Authentication
- "traefik.http.routers.traefik-rtr.middlewares=chain-basic-auth@file" # For Basic HTTP Authentication
#- "traefik.http.routers.traefik-rtr.middlewares=chain-authelia@file" # For Authelia Authentication
Anyone have any ideas? I am pretty stumped.
