Docker Provider: Exposed by specific label

I have two traefik services running in one swarm to separate internet-facing services and intranet services. (please don't question that, it's very well thought. too much to explain here why it's so)

The intranet-instance does not have acme enabled, while the internet-facing has.
Now, both traefik services are listening on all docker services because of the "enabled"-label.
As you guess, the traefik-intranet-instance now complains about not being able to obtain ACME certificates for intranet services.

It would be very convenient to configure every traefik instance at the [docker] provider stanza, on which labels it's allowed to listen, instead of just "exposedbydefault = true", like for example:
"exposedbylabel = intranet" and "exposedbylabel = public" and on docker services instead of "traefik.enable=true" like "traefik.enable=intranet" or "traefik.enablebylabel=intranet" or such...

Is that anyhow possible even with a workaround?

Hello @port22,

What you are wanting to do is use constraints (https://docs.traefik.io/v1.7/configuration/commons/#constraints).

This will allow you to have constraints applied to what each Traefik instance will watch.

This will allow you to have a constraint to filter on those labels.

1 Like

uh! god that was fast :smiley:

okay so as I understand:

[docker]
constraints = ["tag==intranet"]

but how do I set this at a docker service create syntax?
--label "traefik.tag=intranet" ?

cant find it in the docs -.-

The documentation behind https://docs.traefik.io/ is now the v2.

For other version, you can use the "version" menu item.

| traefik.tags=foo,bar,myTag | Adds Traefik tags to the Docker container/service to be used in constraints. |

1 Like

sorry I just found out the url changed (googles fault! :smiley: )

yeah, that seems to work. Once again I am stunned how awesome traefik is, really!

Thanks so much!

1 Like