# Acme storage volume on Windows

**URL:** https://community.traefik.io/t/acme-storage-volume-on-windows/10439
**Category:** Traefik v2
**Tags:** docker, letsencrypt-acme
**Created:** [April 23, 2021, 4:39pm UTC](https://community.traefik.io/t/acme-storage-volume-on-windows/10439 "2021-04-23T16:39:25Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Rajven](https://avatars.discourse-cdn.com/v4/letter/r/e36b37/32.png) [@Rajven](https://community.traefik.io/u/Rajven)
#### Post date: [April 23, 2021, 4:39pm UTC](https://community.traefik.io/t/acme-storage-volume-on-windows/10439/1 "2021-04-23T16:39:25Z")

</div>

I'm running a Windows server trying to set up Traefik in Docker (Linux containers) with acme enabled and I'm encountering the famous:  
`unable to get ACME account: permissions 755 for /acme.json are too open, please use 600`

I've seen some tips to do a `chmod 600 acme.json`, but that doesn't work if I do it from inside WSL or Git bash and then start the container. And what I'm trying to do is create a server that I can easily re-create without a lot of manual steps that I have to do before everything is up and running. And I'd prefer it if I didn't have to do a image of my own where I set the permissions to the file.

Is there some way I can do this through only the docker-compose file, or creating a docker volume beforehand, or scripting?

If you think including my current config here would help, I'd be happy to do it.

---

<div class="post-metadata">

### Author: ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)
#### Post date: [April 23, 2021, 5:11pm UTC](https://community.traefik.io/t/acme-storage-volume-on-windows/10439/2 "2021-04-23T17:11:58Z")

</div>

Try a docker volume instead of a bind mount.

---

<div class="post-metadata">

### Author: ![Rajven](https://avatars.discourse-cdn.com/v4/letter/r/e36b37/32.png) [@Rajven](https://community.traefik.io/u/Rajven)
#### Post date: [April 23, 2021, 5:48pm UTC](https://community.traefik.io/t/acme-storage-volume-on-windows/10439/3 "2021-04-23T17:48:53Z")

</div>

You mean something like

1. Run  
`docker volume create acme_data`

2. In my `docker-compose.yml`:

```auto
services:
  traefik:
    image: traefik:v2.4
    volumes:
      - "acme_data:/acme_data/"

volumes:
  acme_data:
    external: true

```

1. In my static configuration file `traefik.yml`

```auto
certificatesResolvers:
  letsencrypt:
    acme:
     storage: /acme_data/acme.json

```

That seems to work. Maybe I'm just stupid. I feel like I have more control if I can have `acme.json` in the same folder as my config and everything, where I can see it. But I guess it doesn't matter if it's in some Docker generated folder. It would only be an issue if I move to another server, and then it could just request a new certificate.

I guess this works. Thanks! 🙂

---

<div class="post-metadata">

### Author: ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)
#### Post date: [April 23, 2021, 6:53pm UTC](https://community.traefik.io/t/acme-storage-volume-on-windows/10439/4 "2021-04-23T18:53:09Z")

</div>

> [@Rajven](#):
>
> It would only be an issue if I move to another server, and then it could just request a new certificate.

You can copy in or out of a container or even mount it with another container to `cat` it or upload via cli.

`docker cp container:/path/to/file localfilename`  
`docker run --rm -it -v acme-data:/data bash cat /data/acme/json`

> [@Rajven](#):
>
> I guess this works. Thanks! 🙂

You're welcome

---

<div class="post-metadata">

### Author: ![Rajven](https://avatars.discourse-cdn.com/v4/letter/r/e36b37/32.png) [@Rajven](https://community.traefik.io/u/Rajven)
#### Post date: [April 23, 2021, 7:21pm UTC](https://community.traefik.io/t/acme-storage-volume-on-windows/10439/5 "2021-04-23T19:21:18Z")

</div>

Thanks for trying to improve on the solution.

That would require me running some script regularly, or before and after I setup on a new server, right?  
Since changes would not be reflected automatically.  
That's certainly a way to go. But I'm not expecting to do that often, I mostly just want to easily replicate the setup if I need to set it up again.  
So I think I'll just go with the original solution and if I have to move to a new computer It'll just have to request a new certificate.

Since my post detailing my interpretation of your solution is the most complete with examples, I'll mark that as the solution.

Thanks again!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)
#### Post date: [April 26, 2021, 7:21pm UTC](https://community.traefik.io/t/acme-storage-volume-on-windows/10439/6 "2021-04-26T19:21:57Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.
