I have two traefik services running in one swarm to separate internet-facing services and intranet services. (please don't question that, it's very well thought. too much to explain here why it's so)
The intranet-instance does not have acme enabled, while the internet-facing has.
Now, both traefik services are listening on all docker services because of the "enabled"-label.
As you guess, the traefik-intranet-instance now complains about not being able to obtain ACME certificates for intranet services.
It would be very convenient to configure every traefik instance at the [docker] provider stanza, on which labels it's allowed to listen, instead of just "exposedbydefault = true", like for example:
"exposedbylabel = intranet" and "exposedbylabel = public" and on docker services instead of "traefik.enable=true" like "traefik.enable=intranet" or "traefik.enablebylabel=intranet" or such...