Hey,
Tried that, and I think it is getting closer but it still seems to think the certs are invalid.
Initially nothing seemed to change even with the environment variable set for the traefik docker, so I added a delay before check of 360 to the dnsChallenge (1 minute longer than the delay I had set in the environment variable).
This was the output I got:
{"level":"info","msg":"Server configuration reloaded on :443","time":"2019-08-24T00:17:08Z"}
{"level":"info","msg":"Server configuration reloaded on :8080","time":"2019-08-24T00:17:08Z"}
{"level":"info","msg":"Server configuration reloaded on :80","time":"2019-08-24T00:17:08Z"}
{"level":"debug","msg":"Building ACME client...","time":"2019-08-24T00:17:09Z"}
{"level":"debug","msg":"https://acme-v02.api.letsencrypt.org/directory","time":"2019-08-24T00:17:09Z"}
{"level":"info","msg":"Register...","time":"2019-08-24T00:17:10Z"}
{"level":"debug","msg":"Using DNS Challenge provider: digitalocean","time":"2019-08-24T00:17:10Z"}
{"level":"debug","msg":"Delaying 360000000000 rather than validating DNS propagation now.","time":"2019-08-24T00:17:12Z"}
{"level":"debug","msg":"Certificates obtained for domains [mydomain.nz]","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Configuration received from provider ACME: {}","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Wiring frontend frontend-Host-mydomain-nz-2 to entryPoint https","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Creating backend backend-heimdall-setup","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Adding TLSClientHeaders middleware for frontend frontend-Host-mydomain-nz-2","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Creating load-balancer wrr","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Creating server server-heimdall-ec2771a84e365132605d64ba3ab37537 at http://192.168.1.250:80 with weight 1","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Creating retries max attempts 1","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Creating route route-frontend-Host-mydomain-nz-2 Host:mydomain.nz","time":"2019-08-24T00:23:23Z"}
// ...
{"level":"debug","msg":"Adding certificate for domain(s) mydomain.nz","time":"2019-08-24T00:23:23Z"}
{"level":"info","msg":"Server configuration reloaded on :443","time":"2019-08-24T00:23:23Z"}
{"level":"info","msg":"Server configuration reloaded on :8080","time":"2019-08-24T00:23:23Z"}
{"level":"info","msg":"Server configuration reloaded on :80","time":"2019-08-24T00:23:23Z"}
{"level":"debug","msg":"Basic auth failed","time":"2019-08-24T00:25:20Z"}
{"level":"debug","msg":"Basic auth failed","time":"2019-08-24T00:25:25Z"}
{"level":"warning","msg":"A new release has been found: 1.7.14. Please consider updating.","time":"2019-08-24T00:27:09Z"}
{"level":"debug","msg":"Serving default cert for request: \"158.140.236.43\"","time":"2019-08-24T00:28:20Z"}
{"level":"debug","msg":"http: TLS handshake error from 107.178.236.31:30376: remote error: tls: unknown certificate authority","time":"2019-08-24T00:28:20Z"}
The IP in the very last message I have no idea what that is meant to be but it looks like it is failing there?
Just to confirm here is the block for my traefik docker:
traefik:
image: traefik:v1.7.12
command: --web --docker --docker.watch --docker.domain=${DOMAIN} \ --docker.exposedbydefault=false --acme.domains=${DOMAIN}
container_name: traefik
hostname: traefik networks:
br0:
ipv4_address: 192.168.1.253
volumes: - /var/run/docker.sock:/var/run/docker.sock:ro
- ${CONFIG}/traefik/acme.json:/acme.json
- ${CONFIG}/traefik/traefik.log:/traefik.log
- ${CONFIG}/traefik/access.log:/access.log
- ${CONFIG}/traefik/traefik.toml:/etc/traefik/traefik.toml
- ${CONFIG}/traefik/.htpasswd:/etc/traefik/.htpasswd:ro
environment:
- DO_PROPAGATION_TIMEOUT = 300
- DO_AUTH_TOKEN=???
labels:
traefik.enable: "true"
traefik.frontend.rule: "Host:monitor.${DOMAIN}"
traefik.port: "8080"
traefik.frontend.auth.basic: "${HTPASSWD}"
com.ouroboros.enable: "true"
restart: unless-stopped
EDIT:
I update DO_PROPAGATION_TIMEOUT = 300 to be DO_PROPAGATION_TIMEOUT=300 (wasn't sure if it made a differnce) and now I get the following output:
{"level":"debug","msg":"Adding certificate for domain(s) mydomain.nz","time":"2019-08-24T00:49:27Z"}
{"level":"info","msg":"Server configuration reloaded on :443","time":"2019-08-24T00:49:27Z"}
{"level":"info","msg":"Server configuration reloaded on :8080","time":"2019-08-24T00:49:27Z"}
{"level":"info","msg":"Server configuration reloaded on :80","time":"2019-08-24T00:49:27Z"}
{"level":"warning","msg":"A new release has been found: 1.7.14. Please consider updating.","time":"2019-08-24T00:53:10Z"}
{"level":"debug","msg":"Serving default cert for request: \"\"","time":"2019-08-24T00:55:13Z"}
{"level":"debug","msg":"http: TLS handshake error from 74.82.47.5:64570: tls: client offered an unsupported, maximum protocolversion of 300","time":"2019-08-24T00:56:51Z"}
{"level":"debug","msg":"Serving default cert for request: \"\"","time":"2019-08-24T00:57:16Z"}
{"level":"debug","msg":"http: TLS handshake error from 74.82.47.5:9432: tls: no cipher suite supported by both client and server","time":"2019-08-24T00:57:16Z"}
{"level":"debug","msg":"Serving default cert for request: \"\"","time":"2019-08-24T00:57:47Z"}
{"level":"debug","msg":"http: TLS handshake error from 74.82.47.5:18822: tls: no cipher suite supported by both client and server","time":"2019-08-24T00:57:47Z"}
Cheers.