Cannot access dashboard. Documentation follow through didn't work

Problem:
I've tried to enable basic auth on traefik dashboard. Traefik dashboard isn't protected by basic auth when I visit traefik.mydomain.test
I get page not found 404 page.

Here is my docker-compose.yml

version: '3'

services:
  traefik:
    image: traefik:2.1
    networks:
      - webproxy
    ports:
      - "0.0.0.0:8080:80"
      - "0.0.0.0:8081:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
    labels:
      - "traefik.http.routers.api.rule=Host(`traefik.mydomain.test`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$3m2nQLv9$$qWJpdr/kII1bWzrif5QrR1"

networks:
  webproxy:
    driver: bridge

What am I doing wrong here?

#5561 looks pretty similar, unfortunately I'm not even seeing popup and dashboard.

Case 2:

If I enable insecure flag in config and expose 8080 port of traefik container, I can see traefik dashboard. But basic auth still not working.

api:
  dashboard: true
  debug: false
  insecure: true

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    watch: true
version: '3'

services:
  traefik:
    image: traefik:2.1
    networks:
      - webproxy
    ports:
      - "0.0.0.0:8080:80"
      - "0.0.0.0:8081:443"
      - "0.0.0.0:8090:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
    labels:
      - "traefik.http.routers.api.rule=Host(`traefik.mydomain.test`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$3m2nQLv9$$qWJpdr/kII1bWzrif5QrR1"

networks:
  webproxy:
    driver: bridge

@dduportal can you check this out?

Can it be you are missing entrypoints?

traefik.http.routers.api.entrypoints=http

As the directive exposedByDefault is set to false in your static Traefik configuration,
then you must add the label traefik.enable=true if you want Traefik to pick the container :slight_smile:

1 Like

I am also facing the same issue, I am not able to get the api and dashboard working following the steps in the documentation. Here is my docker-compose file. Any help is very much appreciated

version: "3.3"

services:

  whoami:
    image: "containous/whoami"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`test.com`)"
      - "traefik.http.routers.whoami.entrypoints=web"
      - "traefik.http.services.whoami.loadbalancer.server.port=80"

  reverse-proxy:
    image: traefik:v2.0 # The official Traefik docker image
    command:
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--log.level=DEBUG"
      - "--accesslog=true"
      - "--api=true"
      - "--api.dashboard=true"
    ports:
      - "80:80"     # The HTTP port
      - "8080:8080" # The Web UI (enabled by --api)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
    labels:
      - "traefik.http.routers.proxy.rule=Host(`traefik.test.com`)"
      - "traefik.http.routers.proxy.service=api@internal"
      - "traefik.http.routers.proxy.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"

I am able to access the whoami service using test.com however i am not able to access the dashboard or api. I have checked the proxy logs, looks like the labels configured for proxy are not picked by traefik. Here is the corresponding log

$> docker-compose logs reverse-proxy
Attaching to traefik_reverse-proxy_1
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=info msg="Configuration loaded from flags."
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=info msg="Traefik version 2.0.5 built on 2019-11-14T18:11:01Z"
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Static configuration loaded {\"global\":{\"checkNewVersion\":true},\"serversTransport\":{\"maxIdleConnsPerHost\":200},\"entryPoints\":{\"web\":{\"address\":\":80\",\"transport\":{\"lifeCycle\":{\"graceTimeOut\":10000000000},\"respondingTimeouts\":{\"idleTimeout\":180000000000}},\"forwardedHeaders\":{}}},\"providers\":{\"providersThrottleDuration\":2000000000,\"docker\":{\"watch\":true,\"endpoint\":\"unix:///var/run/docker.sock\",\"defaultRule\":\"Host(`{{ normalize .Name }}`)\",\"swarmModeRefreshSeconds\":15000000000}},\"api\":{\"dashboard\":true},\"log\":{\"level\":\"DEBUG\",\"format\":\"common\"},\"accessLog\":{\"format\":\"common\",\"filters\":{},\"fields\":{\"defaultMode\":\"keep\",\"headers\":{\"defaultMode\":\"drop\"}}}}"
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=info msg="\nStats collection is disabled.\nHelp us improve Traefik by turning this feature on :)\nMore details on: https://docs.traefik.io/v2.0/contributing/data-collection/\n"
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="No default certificate, generating one"
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=info msg="Starting provider aggregator.ProviderAggregator {}"
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=info msg="Starting provider *docker.Provider {\"watch\":true,\"endpoint\":\"unix:///var/run/docker.sock\",\"defaultRule\":\"Host(`{{ normalize .Name }}`)\",\"swarmModeRefreshSeconds\":15000000000}"
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Start TCP Server" entryPointName=web
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Provider connection established with docker 19.03.5 (API 1.40)" providerName=docker
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Filtering disabled container" container=reverse-proxy-traefik-01746e181ee220d2f87fe4e35c44fe65041bdb7ada67c1e093d71b7f151c4956 providerName=docker
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Configuration received from provider docker: {\"http\":{\"routers\":{\"whoami\":{\"entryPoints\":[\"web\"],\"service\":\"whoami\",\"rule\":\"Host(`test.com`)\"}},\"services\":{\"whoami\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://172.23.0.2:80\"}],\"passHostHeader\":true}}}},\"tcp\":{}}" providerName=docker
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Creating middleware" middlewareType=Pipelining entryPointName=web routerName=whoami@docker serviceName=whoami middlewareName=pipelining
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Creating load-balancer" routerName=whoami@docker serviceName=whoami entryPointName=web
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Creating server 0 http://172.23.0.2:80" serverName=0 entryPointName=web routerName=whoami@docker serviceName=whoami
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Added outgoing tracing middleware whoami" entryPointName=web routerName=whoami@docker middlewareName=tracing middlewareType=TracingForwarder
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="Creating middleware" middlewareType=Recovery entryPointName=web middlewareName=traefik-internal-recovery
reverse-proxy_1  | time="2019-11-23T19:08:28Z" level=debug msg="No default certificate, generating one"

I guess you meant traefik.enable=true, i added this to my traefik labels and now i can access the api and dashboard

It's not working.

Cool, now your basic auth working on your dashboard? That's the problem.

Thanks for the comment. I have tried to add

      - "traefik.enable=true"
      - "traefik.http.routers.api.entrypoints=http" # or https

these labels, both didn't work.

I think my issue is easily reproducable.

Hi @rnmkr, you have to use http://traefik.mydomain.test:8080 in your case:

  • Port 8080 because your published the 8080 to the 80 of traefik container in Docker:
ports:
      - "0.0.0.0:8080:80"

If you want to reach the standard port, you must adapt this NAT rule: this is outside Traefik :slight_smile:

  • HTTP protocol (instead of HTTPS), because you did not enable TLS on the router. Here are the labels if you want to have https enabled + http to https redirection for the dashboard. Please note that certificate will be auto-signed and will change on each traefik restart or new router: you'll have to provide your own certificate manually or use let's encrypt (ref. https://docs.traefik.io/v2.1/https/tls/#certificates-definition).
version: '3'

services:
  traefik:
    image: traefik:2.1
    networks:
      - webproxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.api.entrypoints=http"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.routers.api.middlewares=redirect-to-https"
      - "traefik.http.routers.api-secure.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.api-secure.service=api@internal"
      - "traefik.http.routers.api-secure.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$apr1$3m2nQLv9$qWJpdr/kII1bWzrif5QrR1"
      - "traefik.http.routers.api-secure.entrypoints=https"
      - "traefik.http.routers.api-secure.tls=true"

networks:
  webproxy:
    driver: bridge

with

api:
  dashboard: true
  debug: false

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    watch: true