Hello,
Following this thread, I'm looking for explanations and help.
Configurations:
- Ubuntu 20.04
- Nomad 1.1.6
- Consul 1.10.3
- Traefik 2.5.3
Problem is, when I used consul connect to communicate between app and database. Traefik have strange behavior (for me, I don't know... 
)
Traefik send to wrong port, it sends to connect-proxy-traccar port instead of webinterface port like indicate in nomad job.
I need to add this tag to my nomad job:
"traefik.http.services.domain.loadbalancer.server.port=${NOMAD_HOST_PORT_webinterface}"
With this, traefik sends to right port, but new problem! 
Backend is now en in https instead of http !
And I have beautiful Internal server error when I check in my browser.
Traefik job:
job "traefik.domain.tld" {
region = "global"
datacenters = ["dc1"]
type = "service"
update {
max_parallel = 1
canary = 1
min_healthy_time = "10s"
healthy_deadline = "5m"
auto_revert = true
auto_promote = true
health_check = "checks"
stagger = "30s"
}
group "traefik.domain.tld" {
count = 1
restart {
attempts = 10
interval = "5m"
delay = "10s"
mode = "delay"
}
ephemeral_disk {
size = 300
sticky = "true"
migrate = true
}
network {
port "traefik_ssl_ui" {
to = 443
static = 443
}
port "traefik_ui" {
to = 80
static = 80
}
}
service {
name = "traefik"
port = "traefik_ssl_ui"
tags = [
"traefik.enable=true",
"traefik.http.routers.traefikdomaintld.tls=true",
"traefik.http.routers.traefikdomaintld.tls.certresolver=myresolver",
"traefik.http.routers.traefikdomaintld.tls.options=mintls12@file",
"traefik.http.routers.traefikdomaintld.entrypoints=https",
"traefik.http.routers.traefikdomaintld.rule=Host(`traefik.domain.tld`)",
"traefik.http.middlewares.traefikdomaintld.redirectscheme.scheme=https",
"traefik.http.middlewares.traefikdomaintld.redirectscheme.permanent=true",
"traefik.http.middlewares.traefikdomaintld-headers.headers.customResponseHeaders.X-Robots-Tag=all",
"traefik.http.middlewares.traefikdomaintld-headers.headers.customResponseHeaders.Strict-Transport-Security=max-age=63072000",
"traefik.http.middlewares.traefikdomaintld-headers.headers.frameDeny=true",
"traefik.http.middlewares.traefikdomaintld-headers.headers.browserXssFilter=true",
"traefik.http.middlewares.traefikdomaintld-headers.headers.contentTypeNosniff=true",
"traefik.http.middlewares.traefikdomaintld-headers.headers.stsIncludeSubdomains=true",
"traefik.http.middlewares.traefikdomaintld-headers.headers.stsPreload=true",
"traefik.http.middlewares.traefikdomaintld-headers.headers.stsSeconds=31536000",
"traefik.http.middlewares.traefikdomaintld-headers.headers.forceSTSHeader=true",
"traefik.http.middlewares.traefikdomaintld-headers.headers.accessControlMaxAge=15552000",
"traefik.http.middlewares.traefikdomaintld-headers.headers.customFrameOptionsValue=SAMEORIGIN",
"traefik.http.middlewares.traefikdomaintld-basicauth.basicauth.users=xxx:xxx",
"traefik.http.routers.traefikdomaintld.middlewares=traefikdomaintld-basicauth@consulcatalog,traefikdomaintld-headers@consulcatalog",
"traefik.http.routers.traefikdomaintld.service=api@internal",
"traefik.consulcatalog.connect=false"
]
check {
name = "traefik"
type = "tcp"
interval = "10s"
timeout = "2s"
}
}
task "traefik" {
driver = "docker"
config {
image = "traefik:latest"
ports = ["traefik_ui", "traefik_ssl_ui"]
volumes = [
"local/traefik.toml:/etc/traefik/traefik.toml",
"local/traefik_tls.toml:/etc/traefik/traefik_tls.toml",
"/data/traefik.domain.tld/letsencrypt:/letsencrypt",
"/data/traefik.domain.tld/conf:/conf",
"/data/traefik.domain.tld/logs:/logs"
]
}
template {
change_mode = "noop"
destination = "local/traefik_tls.toml"
data = <<EOH
[tls.options]
[tls.options.mintls13]
minVersion = "VersionTLS13"
[tls.options.mintls12]
minVersion = "VersionTLS12"
cipherSuites = [
# "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
# "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_AES_256_GCM_SHA384",
"TLS_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
# "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
# "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
]
curvePreferences = [
"CurveP521",
"CurveP384"
]
sniStrict = true
EOH
}
template {
change_mode = "noop"
destination = "local/traefik.toml"
data = <<EOH
[global]
checkNewVersion = false
sendAnonymousUsage = false
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.http]
[entryPoints.http.http.redirections]
[entryPoints.http.http.redirections.entrypoint]
to = "https"
scheme = "https"
[entryPoints.https]
address = ":443"
[api]
dashboard = true
insecure = true
# debug = true
[metrics]
[metrics.prometheus]
buckets = [0.1,0.3,1.2,5.0]
entryPoint = "https"
[log]
# level = "warn"
# level = "info"
level = "debug"
[accessLog]
filePath = "/logs/access.log"
bufferingSize = 1000
[certificatesResolvers.myresolver.acme]
email = "admin@quanticware.com"
storage = "/letsencrypt/acme.json"
[certificatesResolvers.myresolver.acme.httpChallenge]
entryPoint = "http"
[providers.consulCatalog]
prefix = "traefik"
exposedByDefault = false
connectAware = true
connectByDefault = true
[providers.consulCatalog.endpoint]
address = "172.17.0.1:8500"
scheme = "http"
[providers.file]
filename = "/etc/traefik/traefik_tls.toml"
EOH
}
resources {
cpu = 256
memory = 256
}
}
}
}
I see in somes theards consul native parameters and ACL, ok, but for my case, If I just want traefik sends web traffic to right port and with http scheme to avoid Internal Server Error
Thanks for your help! 
