# Basic setup traefik with proxmox docker swarm lxc vm and docker swarm - i cannot get certificate for my other conatainer and vm under proxmox
**URL:** https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984
**Category:** Traefik v3 (latest)
**Tags:** docker, docker-swarm
**Created:** [July 22, 2025, 3:19am UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984 "2025-07-22T03:19:06Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Cyqpann](https://community.traefik.io/u/Cyqpann)
#### Post date: [July 22, 2025, 3:19am UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/1 "2025-07-22T03:19:06Z")
Hi,
first : im fairly new to technical pc and networking and all the developement and all the stuff that is around website security and proxy stuff.
my knowledge is 2/10 up to now.
my goal run 2 wordpress into container with custom nodejs. my son goal, run as many minecraft as possible until it saturate.
my daughter.. she want her blog... wordpress once again.
my wife want his own website too.
so now nothing else work..
I had a good friend who was a network administrator. He helped me set up my home network for both personal and enterprise-level development. Unfortunately, he passed away around four months ago, and since then, I’ve been left alone trying to manage a setup I don’t fully understand and since all my cert expired last month, i had good plan to fix my networking and make this more efficent.
## so here my config, sorry if it a bit unclear.
```auto
My main router is: opnsense:
10.0.100.1 - opnsense.domain.com
Type: Physical Dell Server R620
RAM: 256 GB
Status: Online
VLAN 10 → 10.0.10.0/24 : Physical PCs in the house (me & my wife for controlling the network)
VLAN 20 → 10.0.20.0/24 : My son's work computer
VLAN 30 → My wife's work computer
VLAN 40 → My own work computer
VLAN 50 → (Reserved or unspecified)
VLAN 100 → 10.0.100.0/24 : Physical servers & access points
in AP, there many vlan associate diwht different name that point toward everyone ip to prevent security.
here my opnsense
[igb1_Fred_physical_vlan10] lan = VLAN 10 → 10.0.10.0/24 : Physical PCs in the house (me)
igb1
[igb1_v50_Fred_Server_v50] opt7 = my 10.0.50.1/24 = my lxc container are there with my vm for my business and development.
vlan0.1.50 igb1_Fred_Server (Parent: igb1, Tag: 50)
[igb1_v80_Sarah_Server] opt10 10.0.80.1/24 = my wife physical srv and work srv are there.
vlan0.1.80 igb1_Sarah_Server (Parent: igb1, Tag: 80)
my son network and his private minecraft srv
[igb2_Jonathan] opt2
igb2
[igb2_v60_Jonathan_Server] opt8
vlan0.1.60 igb2_Jonathan_Server (Parent: igb1, Tag: 60)
my daughter pc and his game srv for minecraft.
[igb3_Jayden] opt3
igb3
[igb3_v70_Jayden_Server] opt9
vlan0.1.70 igb3_Jayden_Server (Parent: igb1, Tag: 70)
it was planned for business people logging from AP to have internet with captive portal that will come to business house. it doesnt work properly yet.
[igb4_Guest] opt4
igb4
-----
all my physical srv are there with physical physical AP, Rpi2,
vlan 100 = 10.0.100.1/24 : ipv6: 2001:470:b185:100::1
[igb7_MGMT] opt1
igb7
```
I have multiple physical Dell servers with 1024 GB of RAM each. Here’s how they are configured:
| Hostname | IP Address | Port | Role | Status |
| --- | --- | --- | --- | --- |
| `alpha.domain.com` | `10.0.100.10` | 8006 | Proxmox physical server | ✅ Running |
| `bravo.domain.com` | `10.0.100.11` | 8006 | Proxmox physical server | ✅ Running |
| `pbs.domain.com` | `10.0.100.12` | 8006 | Proxmox Backup Server | ✅ Running |
| `karen.domain.com` | `10.0.100.13` | 8006 | Proxmox physical server | ⏸ Not yet active |
| `laylah.domain.com` | `10.0.100.14` | 8006 | Proxmox physical server | ⏸ Not yet active |
In early 2023, we created an LXC container to run **Nginx Proxy Manager** (NPM), which handled reverse proxies and wildcard SSL certificates through my `domain.com`. Everything was working great until 4 days ago.
After discussing with ChatGPT, I learned that **Cloudflare** can automatically manage SSL certificates for my domain. I also found out that **OPNsense** can handle certificate renewal automatically for all my domain and my son and wife domain aswell.
Since I barely knew Linux and had only basic Windows knowledge at the time, I gradually learned how to:
- Create and manage basic LXC containers,
- Understand VLAN basics and ssh. im lost into ca certificate authorities, and all that stuffs lol. dns nightmare to understand lol.
- Set up VM networking
- Brand new to work with Docker and Ubuntuand linux in general.
Eventually, ChatGPT recommended that I switch to **Traefik** combined with Docker Swarm for easier certificate and service management since i have a nasty complex network at home and at business and since i struggle to take care of ssl properly on stress period if everything shutdown or is not accessible.,
If that can assign automatically and properly like npm used to do, and i need to do the less config to make thing work, the better is.
so i create 2 ubuntu vm and with docker and ubuntu02 swarm and first thing i installed is traefik..
so i shutdown npm, since it use 80 and 443, i cloned the rule in opnsense and change for the ip of traefik. i think nat is done properly too since i clone it too.
now the problem is , all my other vm or container that arent into docker or swarm or outside of the same vm that is 10.0.50.80/24 as docker doesnt get certificate automatically or not at all.
here my log error. :
```auto
traefik_traefik.1.45rlk89vjwzx@budget01 | 2025-07-22T01:59:24Z ERR Unable to obtain ACME certificate for domains error="cannot get ACME client cloudflare: some credentials information are missing: CLOUDFLARE_EMAIL,CLOUDFLARE_API_KEY or some credentials information are missing: CLOUDFLARE_DNS_API_TOKEN,CLOUDFLARE_ZONE_API_TOKEN" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["cloud.domain.com"] providerName=le.acme routerName=cloud@file rule=Host(`cloud.domain.com`)
root@budget01:/opt/traefik# tree /opt/traefik/
```
tree /opt/traefik/
```auto
root@budget01:/opt/traefik# tree /opt/traefik/
/opt/traefik/
├── acme
│ └── acme.json
├── acme.json
├── certs
│ ├── cert.pem
│ ├── chain.pem
│ ├── fullchain.pem
│ ├── local.crt
│ └── local.key
├── docker-compose.yml
├── dynamic
│ ├── alpha.yaml
│ ├── lxc-services.yml
│ ├── mail.yaml
│ ├── opnsense.yaml
│ └── tls.yml.bak
├── dynamic.yaml
├── letsencrypt
│ └── acme.json
├── private
│ └── privkey.pem
└── traefik.yml
```
acme.json
```auto
{
"letsencrypt": {
"Account": {
"Email": "emailhere@domain.com",
"Registration": {
"body": {
"status": "valid"
},
"uri": "https://acme-v02.api.letsencrypt.org/acme/acct/111111111"
},
"PrivateKey": "key here it's valid==",
"KeyType": "4096"
},
"Certificates": null
}
}
```
alpha.yaml
```auto
http:
routers:
alpha-router:
rule: "Host(`alpha.domain.com`)"
entryPoints:
- websecure
service: alpha-service
tls:
certResolver: le
services:
alpha-service:
loadBalancer:
servers:
- url: "https://10.0.100.10:8006"
serversTransport: insecure-skip
serversTransports:
insecure-skip:
insecureSkipVerify: true
```
lxc-services.yml
```auto
http:
routers:
mail:
rule: "Host(`mail.domain.com`)"
entryPoints: [websecure]
service: mail
tls:
certResolver: le
opnsense:
rule: "Host(`opnsense.domain.com`)"
entryPoints: [websecure]
service: opnsense
tls:
certResolver: le
cloud:
rule: "Host(`cloud.domain.com`)"
entryPoints: [websecure]
service: cloud
tls:
certResolver: le
pgm:
rule: "Host(`pmg.domain.com`)"
entryPoints: [websecure]
service: pgm
tls:
certResolver: le
services:
mail:
loadBalancer:
servers:
- url: "http://10.0.50.29"
opnsense:
loadBalancer:
servers:
- url: "http://10.0.100.1"
cloud:
loadBalancer:
servers:
- url: "http://10.0.50.41"
pmg:
loadBalancer:
servers:
- url: "http://10.0.50.33"
```
mail.yaml
```auto
http:
routers:
mail-router:
rule: "Host(`mail.domain.com`)"
entryPoints:
- websecure
service: mail-service
tls:
certResolver: le # DNS challenge (Cloudflare)
services:
mail-service:
loadBalancer:
servers:
- url: "https://10.0.50.29"
serversTransport: allow-insecure
serversTransports:
allow-insecure:
insecureSkipVerify: true
```
opnsense.yaml
```auto
http:
routers:
opnsense-router:
rule: "Host(`opnsense.domain.com`)"
entryPoints:
- websecure
service: opnsense-service
tls:
certResolver: le
services:
opnsense-service:
loadBalancer:
servers:
- url: "http://10.0.100.1:443"
```
```auto
/letsencrypt
acme.json
{
"le": {
"Account": {
"Email": "heremailhereisvalid@domain.com",
"Registration": {
"body": {
"status": "valid"
},
"uri": "https://acme-v02.api.letsencrypt.org/acme/acct/1111111111"
},
"PrivateKey": "key here",
"KeyType": "4096"
},
"Certificates": [
{
"domain": {
"main": "whoami.domain.com"
},
"certificate": "key here",
"Store": "default"
},
{
"domain": {
"main": "traefik.domain.com"
},
"certificate": "key here",
"key": "key here",
"Store": "default"
}
]
}
}
```
.env
```auto
CLOUDFLARE_EMAIL=emailhereisvalid@domain.com
CF_API_KEY=886756f3fc45d1cf0fd3cc40c917e319b8901
CF_DNS_API_TOKEN=ekrB7ECUSc_UT2ldQTm64MMlWAqiATRzg3F7dwuA
```
docker-compose.yml
```auto
version: "3.8"
services:
traefik:
image: traefik:v3.4.4
command:
- "--api.dashboard=true"
- "--log.level=INFO"
- "--providers.swarm=true"
- "--providers.swarm.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.le.acme.dnschallenge=true"
- "--certificatesresolvers.le.acme.dnschallenge.provider=cloudflare"
- "--certificatesresolvers.le.acme.dnschallenge.delaybeforecheck=10"
#- "--certificatesresolvers.le.acme.httpchallenge=true"
#- "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
- "--certificatesresolvers.le.acme.email=emailhereisvalid@domain.com"
- "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
- "--providers.file.directory=/dynamic"
- "--providers.file.watch=true"
environment:
- CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
- TRAEFIK_LOG_LEVEL=DEBUG}
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./letsencrypt:/letsencrypt
- ./dynamic:/dynamic
networks:
- traefik-public
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.rule=Host(`traefik.domain.com`)"
- "traefik.http.routers.traefik.entrypoints=websecure"
- "traefik.http.routers.traefik.service=api@internal"
- "traefik.http.routers.traefik.tls=true"
- "traefik.http.routers.traefik.tls.certresolver=le"
- "traefik.http.routers.traefik.middlewares=auth,ipallowlist"
- "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$BJhib8pa$$cswpEBr0eqvQWgww12rzb/"
- "traefik.http.middlewares.ipallowlist.ipallowlist.sourcerange=10.0.0.0/24,127.0.0.1"
- "traefik.http.services.traefik.loadbalancer.server.port=8080"
whoami:
image: traefik/whoami
networks:
- traefik-public
deploy:
labels:
- "traefik.enable=true"
- "traefik.http.routers.whoami.rule=Host(`whoami.domain.com`)"
- "traefik.http.routers.whoami.entrypoints=websecure"
- "traefik.http.routers.whoami.tls=true"
- "traefik.http.routers.whoami.tls.certresolver=le"
- "traefik.http.services.whoami.loadbalancer.server.port=80"
- "traefik.http.routers.whoami.middlewares=ipallowlist"
- "traefik.http.middlewares.ipallowlist.ipallowlist.sourcerange=10.0.0.0/24,127.0.0.1"
volumes:
letsencrypt:
networks:
traefik-public:
external: true
```
dymanic.yaml
```auto
http:
routers:
opnsense-router:
rule: "Host(`opnsense.domain.com`)"
service: opnsense-service
entryPoints:
- websecure
tls:
certResolver: le
alpha-router:
rule: "Host(`alpha.domain.com`)"
service: alpha-service
entryPoints:
- websecure
tls:
certResolver: le
services:
opnsense-service:
loadBalancer:
servers:
- url: "http://10.0.100.1"
alpha-service:
loadBalancer:
servers:
- url: "https://10.0.100.10:8006"
tls:
certificates:
- certFile: "/etc/traefik/certs/fullchain.pem"
keyFile: "/etc/traefik/private/privkey.pem"
```
traefik.yml
```auto
entryPoints:
web:
address: ":80"
websecure:
address: ":443"
api:
dashboard: true
log:
level: INFO
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
network: traefik-public
file:
directory: /etc/traefik/dynamic
watch: true
certificatesResolvers:
le:
acme:
email: "emailhereisvalid@domain.com"
storage: "/letsencrypt/acme.json"
dnsChallenge:
provider: cloudflare
delayBeforeCheck: 0
resolvers:
- "1.1.1.1:53"
- "8.8.8.8:53"
```
what im trying to do
every new vm or lxc container created need to get add to this traefik to get ssl et https all the time. i dont mind adding it to the list manually if i created a new container.
the traefik suggestion and docker withproxmox was chatgpt idea because i need to create automatic https sub domain for my projet.
also my son got on same public ip [blabla.domain2.com](http://blabla.domain2.com) , he also hosting tons of minecraft.
he want to use [https://pterodactyl.io/](https://pterodactyl.io/) to host them but we dont know how to setup security lol.
he into 10.0.60.1/24 for his srv.
so if someone can point me toward the good and proper traefik setup and remove all the crap files i've created over the last weeks with chatpt. i dont understand most part of it.
so far only traefik show my [traefik.domain.com](http://traefik.domain.com) and [whoami.domain.com](http://whoami.domain.com)
all the rest show defaul traefik certificat and doesnt get them from traefik.
my dns server is 10.0.100.1 incase that matter, this is unbound.
cloudflarre is in full https mode unless this matter ?
all email and key are not valid into this post. i modified them.
i can open any port and all port are open to the world.
---
### Author:  [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [July 22, 2025, 6:25am UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/2 "2025-07-22T06:25:21Z")
Seems like a clear error message to me:
`traefik_traefik.1.45rlk89vjwzx@budget01 | 2025-07-22T01:59:24Z ERR Unable to obtain ACME certificate for domains error="cannot get ACME client cloudflare: some credentials information are missing: CLOUDFLARE_EMAIL,CLOUDFLARE_API_KEY or some credentials information are missing: CLOUDFLARE_DNS_API_TOKEN,CLOUDFLARE_ZONE_API_TOKEN" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["cloud.domain.com"] providerName=le.acme routerName=cloud@file rule=Host(`[cloud.domain.com](http://cloud.domain.com)`) `
You got
> [@Cyqpann](#):
>
> ```auto
> environment:
> - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
>
> ```
So maybe try:
```auto
environment:
- CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
- CLOUDFLARE_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
```
---
### Author:  [@Cyqpann](https://community.traefik.io/u/Cyqpann)
#### Post date: [July 22, 2025, 6:50am UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/3 "2025-07-22T06:50:45Z")
I tried your thing
environment:
- CF\_DNS\_API\_TOKEN=${CF\_DNS\_API\_TOKEN}
- CLOUDFLARE\_DNS\_API\_TOKEN=${CF\_DNS\_API\_TOKEN}
in docker-compose
i keep receiving this message...
```auto
/opt/traefik# docker stack deploy -c docker-compose.yml traefik
Since --detach=false was not specified, tasks will be created in the background.
In a future release, --detach=false will become the default.
Updating service traefik_traefik (id: uimr72jg7ujpq1iva9w8vupuw)
Updating service traefik_whoami (id: nqcko2kko1tfcufjfdjyj68om)
root@budget01:/opt/traefik# docker service logs traefik_traefik --tail 100 -f
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z WRN delayBeforeCheck is now deprecated, please use propagation.delayBeforeChecks instead.
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF Traefik version 3.4.4 built on 2025-07-11T08:31:57Z version=3.4.4
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF
traefik_traefik.1.l3gznx0skosq@budget01 | Stats collection is disabled.
traefik_traefik.1.l3gznx0skosq@budget01 | Help us improve Traefik by turning this feature on
traefik_traefik.1.l3gznx0skosq@budget01 | More details on: https://doc.traefik.io/traefik/contributing/data-collection/
traefik_traefik.1.l3gznx0skosq@budget01 |
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF Starting provider aggregator *aggregator.ProviderAggregator
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF Starting provider *file.Provider
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF Starting provider *traefik.Provider
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF Starting provider *docker.SwarmProvider
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF Starting provider *acme.ChallengeTLSALPN
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF Starting provider *acme.Provider
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:17Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=le.acme
traefik_traefik.1.l3gznx0skosq@budget01 | 2025-07-22T06:41:18Z ERR Unable to obtain ACME certificate for domains error="cannot get ACME client cloudflare: some credentials information are missing: CLOUDFLARE_EMAIL,CLOUDFLARE_API_KEY or some credentials information are missing: CLOUDFLARE_DNS_API_TOKEN,CLOUDFLARE_ZONE_API_TOKEN" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["pmg.domain.com"] providerName=le.acme routerName=pgm@file rule=Host(`pmg.domain.com`)
```
im not quite sure what to do honestly. thanks for trying with me !
---
### Author:  [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [July 22, 2025, 11:27am UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/4 "2025-07-22T11:27:37Z")
Have you tried a simple `echo ${CLOUDFLARE_DNS_API_TOKEN}` within Traefik container (`docker exec -it sh`), to see if it is correctly set?
---
### Author:  [@Cyqpann](https://community.traefik.io/u/Cyqpann)
#### Post date: [July 22, 2025, 12:30pm UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/5 "2025-07-22T12:30:31Z")
Inside my docker exec traefik\_traefik.1.xxxxxxxxxxx sh
```auto
/ # echo $CLOUDFLARE_DNS_API_TOKEN
/ # env
CLOUDFLARE_DNS_API_TOKEN=
HOSTNAME=10ssssdsss5dde3
SHLVL=1
HOME=/root
TERM=xterm
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
CF_DNS_API_TOKEN=
PWD=/
/ #
```
i dont' understand.
my .env is at the root of my /opt/traefik/
i did the chmod 600 on the file unless i messed it.
i dont know where it went or where the CF\_DNS\_api\_token= nothing here.
---
### Author:  [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [July 22, 2025, 1:22pm UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/6 "2025-07-22T13:22:31Z")
I think a local `.env` file is only used automatically with `docker compose`. For `docker stack deploy` you need to explicitly specify it within the file using `env_file:`.
---
### Author:  [@Cyqpann](https://community.traefik.io/u/Cyqpann)
#### Post date: [July 22, 2025, 1:35pm UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/7 "2025-07-22T13:35:50Z")
okay im not sure what to do but im hype atm.
i tried for fun in my .env with only
CF\_DNS\_API\_TOKEN=token here
root@budget01:/opt/traefik# docker stack rm docker-compose.yml traefik
root@budget01:/opt/traefik# docker stack deploy -c docker-compose.yml traefik
Since --detach=false was not specified, tasks will be created in the background.
In a future release, --detach=false will become the default.
Updating service traefik\_whoami (id: w89d4b4v2u8pvo9jcpn6hsr91)
Updating service traefik\_traefik (id: qwjoz73rx5um6rwdph013vl7l)
root@budget01:/opt/traefik# docker service logs traefik\_traefik --tail 100 -f
```auto
/ # env
HOSTNAME=30db322daa55
SHLVL=1
HOME=/root
TERM=xterm
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
CF_DNS_API_TOKEN=
PWD=/
```
but if i put the CF\_DNS\_API\_TOKEN=token here
into the docker-compose.yml into environment:
/ # env
HOSTNAME=30db322daa55
SHLVL=1
HOME=/root
TERM=xterm
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
CF\_DNS\_API\_TOKEN=token appear here from the environment.
PWD=/
now my logs show this
```auto
traefik_traefik.1.drs9i8hrwxuu@budget01 | 2025-07-22T13:32:15Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [mail.domain.com]: acme: error: 429 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:rateLimited :: too many failed authorizations (5) for \"mail.domain.com\" in the last 1h0m0s, retry after 2025-07-22 13:33:20 UTC: see https://letsencrypt.org/docs/rate-limits/#authorization-failures-per-hostname-per-account" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["mail.domain.com"] providerName=le.acme routerName=mail-router@file rule=Host(`mail.domain.com`)
traefik_traefik.1.drs9i8hrwxuu@budget01 | 2025-07-22T13:32:15Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [alpha.domain.com]: acme: error: 429 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:rateLimited :: too many failed authorizations (5) for \"alpha.domain.com\" in the last 1h0m0s, retry after 2025-07-22 13:33:19 UTC: see https://letsencrypt.org/docs/rate-limits/#authorization-failures-per-hostname-per-account" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["alpha.domain.com"] providerName=le.acme routerName=alpha-router@file rule=Host(`alpha.domain.com`)
```
am i getting close to something working normally like the other 438563837 users using this 🙂 . im so confuse atm and totally lost.
---
### Author:  [@Cyqpann](https://community.traefik.io/u/Cyqpann)
#### Post date: [July 22, 2025, 2:33pm UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/8 "2025-07-22T14:33:46Z")
I think i've got some news but i had to tweak it with your help.
here what ive done otherwise it doesn't show properly or load it properly
```auto
root@budget01:/opt/traefik# ik# dockervice logs traefik_traefik --tail 100 -fefik
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z WRN delayBeforeCheck is now deprecated, please use propagation.delayBeforeChecks instead.
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF Traefik version 3.4.4 built on 2025-07-11T08:31:57Z version=3.4.4
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF
traefik_traefik.1.vzrunaoi9hxl@budget01 | Stats collection is disabled.
traefik_traefik.1.vzrunaoi9hxl@budget01 | Help us improve Traefik by turning this feature on :)
traefik_traefik.1.vzrunaoi9hxl@budget01 | More details on: https://doc.traefik.io/traefik/contributing/data-collection/
traefik_traefik.1.vzrunaoi9hxl@budget01 |
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF Starting provider aggregator *aggregator.ProviderAggregator
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF Starting provider *file.Provider
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF Starting provider *traefik.Provider
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF Starting provider *acme.Provider
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF Starting provider *docker.SwarmProvider
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=le.acme
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z INF Starting provider *acme.ChallengeTLSALPN
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z ERR Router uses a nonexistent certificate resolver certificateResolver=Letsencrypt routerName=cloud@file
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z ERR Router uses a nonexistent certificate resolver certificateResolver=Letsencrypt routerName=mail@file
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z ERR Router uses a nonexistent certificate resolver certificateResolver=Letsencrypt routerName=opnsense@file
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:08Z ERR Router uses a nonexistent certificate resolver certificateResolver=Letsencrypt routerName=pgm@file
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:09Z ERR Router uses a nonexistent certificate resolver certificateResolver=Letsencrypt routerName=cloud@file
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:09Z ERR Router uses a nonexistent certificate resolver certificateResolver=Letsencrypt routerName=mail@file
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:09Z ERR Router uses a nonexistent certificate resolver certificateResolver=Letsencrypt routerName=opnsense@file
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:09Z ERR Router uses a nonexistent certificate resolver certificateResolver=Letsencrypt routerName=pgm@file
traefik_traefik.1.vzrunaoi9hxl@budget01 | 2025-07-22T14:17:11Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [mail.domain.com]: error: one or more domains had a problem:\n[mail.domain.com] [mail.domain.com] acme: error presenting token: cloudflare: failed to find zone com.: zone could not be found\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["mail.domain.com"] providerName=le.acme routerName=mail-router@file rule=Host(`mail.domain.com`)
root@budget01:/opt/traefik# docker exec -it traefik_traefik.1.vzrunaoi9hxl1gnun57t0kk99 env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=c3e54bd9efba
TERM=xterm
CF_DNS_API_TOKEN=xxxxxxx
CLOUDFLARE_API_KEY=xxxx
CLOUDFLARE_EMAIL=emailhereappear@gmail.com
HOME=/root
root@budget01:/opt/traefik#
```
now in the docker-compose.yml
i had to put
```auto
environment:
#- CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
- CF_DNS_API_TOKEN=xxx
```
Otherwise, it doesnt load in the traefik env
in my .env there:
```auto
CLOUDFLARE_API_KEY=xxxx
CLOUDFLARE_EMAIL=ermaivalid@gmail.com
CF_DNS_API_TOKEN=xxx
```
but even i i remove the environment and only put it into the .env
it doesnt load it.
only way that is added to env is via docker-compose.yml
is it okay, secure and correct?
otherwise i really don't know.
this is my log i've got by the time i written this message. i still got error related to all lxc container you can see.
Do you have something you want me to try, do, experiment, im open to anything.
thanks for your time!!
---
### Author:  [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [July 22, 2025, 2:45pm UTC](https://community.traefik.io/t/basic-setup-traefik-with-proxmox-docker-swarm-lxc-vm-and-docker-swarm-i-cannot-get-certificate-for-my-other-conatainer-and-vm-under-proxmox/27984/9 "2025-07-22T14:45:20Z")
Either place it in `environment:` or use
`env_file: .env` in your stack compose file ([doc](https://docs.docker.com/compose/how-tos/environment-variables/set-environment-variables/)).