# Can't use a subdomain to access traefik dashboard

**URL:** <https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [September 9, 2020, 5:40am UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606 "2020-09-09T05:40:24Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 9, 2020, 5:40am UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/1 "2020-09-09T05:40:24Z")

</div>

Hey !

I'm trying to set up traefik on my vps with the help of docker-compose but I can't fix my issue.

Here is my docker-compose.yml

```auto
version: "3.8"

services:
  proxy:
    image: traefik:v2.1
    command:
      - --api
      - --providers.docker
      - --providers.docker.exposedbydefault=false
    ports:
      - "80:80"
      - "8080:8080"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/traefik/traefik.toml:/traefik.toml
      - /opt/traefik/acme.json:/acme.json
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`dashboard.domain.com`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=user:password"

networks:
  web:
    external: true

```

The problem is that the authentication does not work when i'm going on [dashboard.example.com](http://dashboard.example.com). I tried the exact same configuration just with [example.com](http://example.com) as a domain and it does work, it ask for the authentication when i'm just trying to go on [example.com](http://example.com).

If someone could help me with that I would be grateful 🙂

---

<div class="post-metadata">

**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\
**Post date:** [September 9, 2020, 9:51am UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/2 "2020-09-09T09:51:35Z")

</div>

What's in traefik.toml?

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 9, 2020, 2:10pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/3 "2020-09-09T14:10:52Z")

</div>

Hey ! Here is my traefik.toml file !

```auto

[global]
  sendAnonymousUsage = false

[log]
  level = "INFO"
  format = "common"

[providers]
  [providers.docker]
    endpoint = "unix:///var/run/docker.sock"
    watch = true
    exposedByDefault = true
    swarmMode = false
  [providers.file]
    filename = "/opt/traefik/traefik_dynamic.toml"
    watch = true

[api]
  dashboard = true
  debug = false
  insecure = false

[entryPoints]
  [entryPoints.insecure]
    address = ":80"
  [entryPoints.secure]
    address = ":443"

[certificatesResolvers]
  [certificatesResolvers.letsencrypt]
    [certificatesResolvers.letsencrypt.acme]
      email = "email@example.com"
      caServer = "https://acme-v02.api.letsencrypt.org/directory"
      storage = "acme.json"
      keyType = "EC384"
        [certificatesResolvers.letsencrypt.acme.httpChallenge]
          entryPoint = "web"

```

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 9, 2020, 3:16pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/4 "2020-09-09T15:16:47Z")

</div>

I managed to make it work but the thing is that letsencrypt do not work 😕

I change my docker-compose with this one [https://github.com/containous/blog-posts/blob/master/2019\_09\_10-101\_docker/docker-compose-08.yml](https://github.com/containous/blog-posts/blob/master/2019_09_10-101_docker/docker-compose-08.yml) from Idez

I got no errors but still can't use https.

---

<div class="post-metadata">

**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\
**Post date:** [September 9, 2020, 7:38pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/5 "2020-09-09T19:38:11Z")

</div>

From the [docs](https://docs.traefik.io/getting-started/configuration-overview/#the-static-configuration):

> There are three different, **mutually exclusive** (e.g. you can use only one at the same time), ways to define static configuration options in Traefik:
> 
> 1. In a configuration file
> 2. In the command-line arguments
> 3. As environment variables

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 9, 2020, 10:41pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/6 "2020-09-09T22:41:35Z")

</div>

Yes i've done in the command-line arguments it's all good concerning the subdomain. The thing is that letsencrypt ain't working the way it should 😕

---

<div class="post-metadata">

**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\
**Post date:** [September 9, 2020, 10:43pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/7 "2020-09-09T22:43:02Z")

</div>

Post your updated configuration then if you fixed it since your initial posts.

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 9, 2020, 10:44pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/8 "2020-09-09T22:44:15Z")

</div>

I've posted the link to the doc anyway i'll just copy paste it here :

```auto
version: "3.3"

services:
  traefik:
    image: "traefik:v2.0.1"
    command:
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --providers.docker
      - --api
      - --certificatesresolvers.leresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      - --certificatesresolvers.leresolver.acme.email=your@email.com
      - --certificatesresolvers.leresolver.acme.storage=/acme.json
      - --certificatesresolvers.leresolver.acme.tlschallenge=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./acme.json:/acme.json"
    labels:
      # Dashboard
      - "traefik.http.routers.traefik.rule=Host(`traefik.docker.localhost`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls.certresolver=leresolver"
      - "traefik.http.routers.traefik.middlewares=authtraefik"
      - "traefik.http.middlewares.authtraefik.basicauth.users=user:$$apr1$$q8eZFHjF$$Fvmkk//V6Btlaf2i/ju5n/" # user/password

      # global redirect to https
      - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.entrypoints=web"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"

      # middleware redirect
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

```

---

<div class="post-metadata">

**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\
**Post date:** [September 9, 2020, 10:52pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/9 "2020-09-09T22:52:55Z")

</div>

What's not working? Enable debug logging and examine logs.

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 9, 2020, 11:04pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/10 "2020-09-09T23:04:01Z")

</div>

The navigator always says that this site is dangerous and not securised.

I just added :

```auto
- --log.filePath=/opt/traefik/traefik.log
- --log.level=DEBUG

```

In the command line but nothing appears, do I set it up the wrong way ?

I just tried to use a [whoami.example.com](http://whoami.example.com) and there is the results in the dashboard :

 ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/7/78938755620ac34cf834b4c63b34e98be750f1c2.png)

The TLS does appear but not working.

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 9, 2020, 11:05pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/11 "2020-09-09T23:05:54Z")

</div>

In case you ask for the docker-compose.yml for the whoami :

```auto
  my-app:
    image: containous/whoami:v1.3.0
    labels:
      - "traefik.http.routers.my-app.rule=Host(`whoami.example.com`)"
      - "traefik.http.routers.my-app.middlewares=auth"
      - "traefik.http.routers.my-app.entrypoints=websecure"
      - "traefik.http.routers.my-app.tls=true"
      - "traefik.http.routers.my-app.tls.certresolver=leresolver"
      - "traefik.http.middlewares.auth.basicauth.users=user:$$apr1$$q8eZFHjF$$Fvmkk//V6Btlaf2i/ju5n/" # user/password

```

---

<div class="post-metadata">

**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\
**Post date:** [September 9, 2020, 11:08pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/12 "2020-09-09T23:08:06Z")

</div>

The log would be inside the container if you chose to write it to file.

Examine the cert. If it's staging let's encrypt cert as per your configuration, then the security warning is normal.

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 9, 2020, 11:22pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/13 "2020-09-09T23:22:50Z")

</div>

Nothing inside the container.

Here is the content of acme.json :

```auto
{
  "leresolver": {
    "Account": {
      "Email": "your@email.com",
      "Registration": {
        "body": {
          "status": "valid",
          "contact": [
            "mailto:your@email.com"
          ]
        },
        "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/96253089"
      },
      "PrivateKey": "PrivateKey",
      "KeyType": "4096"
    },
    "Certificates": [
      {
        "domain": {
          "main": "traefik.example.com"
        },
        "certificate": "*certificate*",
        "key": "*key*",
        "Store": "default"
      },
      {
        "domain": {
          "main": "whoami.example.com"
        },
        "certificate": "*certificate*",
        "key": "*key*",
        "Store": "default"
      }
    ]
  }

```

The uri return an error thought but can't fix it

---

<div class="post-metadata">

**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\
**Post date:** [September 10, 2020, 4:41am UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/14 "2020-09-10T04:41:52Z")

</div>

> [@Kaaedan](#):
>
> Nothing inside the container.

Could you please post commands you used to verify it and the output of these commands. Also it would be interesting to find out if `/opt/traefik` exists and if the user traefik running under has permissions to write to `/opt/traefik/traefik.log` In general I'd recommend to start with omitting `log.filePath` altogether and simply inspecting the container log.

Also I would advise to examine the certificate. If it's staging let's encrypt cert as per your configuration, then the security warning is normal. You can tell if it's a staging cert by looking at the issuer field.

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 10, 2020, 5:25am UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/15 "2020-09-10T05:25:50Z")

</div>

I just used docker-compose logs. I'm new to docker-compose / traefik maybe I don't know how to check logs properly.  
Well, after checking traefik.log does not even exist, i don't think he has the permission to write.

How am i suppose to find the issuer field ? I don't see any  
And I have a warning right, but the https does not work. The thing is that user won't get on my websites if they have the " Your Connection is Not Private" message..

---

<div class="post-metadata">

**Author:** ![Kaaedan](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Kaaedan](https://community.traefik.io/u/Kaaedan)\
**Post date:** [September 11, 2020, 12:57am UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/16 "2020-09-11T00:57:52Z")

</div>

If anyone has a clue..

---

<div class="post-metadata">

**Author:** ![jnovack](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jnovack/32/2524_2.png) [@jnovack](https://community.traefik.io/u/jnovack)\
**Post date:** [September 11, 2020, 3:31pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/17 "2020-09-11T15:31:03Z")

</div>

> [@zespri](#):
>
> Also it would be interesting to find out if `/opt/traefik` exists and if the user traefik running under has permissions to write to `/opt/traefik/traefik.log`

I don't think so.. The `traefik` binary is the only thing that's IN the container, and without an OS, nothing can `mkdir /opt/traefik`.

You are probably better off making `log.filePath=/traefik.log`, at least we know the root directory exists.

But, normally, logs written by Traefik are sent to STDOUT, so you do not have any weird logging overrides in docker, a simple `docker-compose logs` should work just fine.

---

<div class="post-metadata">

**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\
**Post date:** [September 11, 2020, 9:36pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/18 "2020-09-11T21:36:22Z")

</div>

> [@jnovack](#):
>
> I don't think so.. The `traefik` binary is the only thing that's IN the container,

@jnovack are you talking about traefik v1? this is a traefik v2 topic. All traefik v2 containers come with an OS.

> [@jnovack](#):
>
> and without an OS, nothing can `mkdir /opt/traefik` .

Surely traefik can do it itself if programmed though, and has permissions but I do not think it is.

> [@jnovack](#):
>
> But, normally, logs written by Traefik are sent to STDOUT, so you do not have any weird logging overrides in docker, a simple `docker-compose logs` should work just fine.

Yep, I already explained that above.

---

<div class="post-metadata">

**Author:** ![jnovack](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jnovack/32/2524_2.png) [@jnovack](https://community.traefik.io/u/jnovack)\
**Post date:** [September 14, 2020, 3:18pm UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/19 "2020-09-14T15:18:26Z")

</div>

> [@zespri](#):
>
> are you talking about traefik v1? this is a traefik v2 topic. All traefik v2 containers come with an OS.

Yep, I stand corrected. Haven't checked since, so I just assumed it didn't have it. #mybad.

---

<div class="post-metadata">

**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/brian/32/2588_2.png) [@brian](https://community.traefik.io/u/brian)\
**Post date:** [September 17, 2020, 6:40am UTC](https://community.traefik.io/t/cant-use-a-subdomain-to-access-traefik-dashboard/7606/20 "2020-09-17T06:40:55Z")

</div>

@Kaaedan Could you try using DNS challenge to see if that works as this works slightly better with subdomains. I made some examples here - [https://github.com/56kcloud/traefik-training/tree/master/04-HTTPS-TLS](https://github.com/56kcloud/traefik-training/tree/master/04-HTTPS-TLS)