How can i enable https on custom port in Docker-compose using LetsEncrypt

Traefik Traefik v2
1

I have a domain name api.test-external.com hosted in cloud dns server. Now i want to have enable https like https://api.test-external.com: **port** for multiple services using same domain. Here is my docker-compose file where i wanted to enable https for both traefik dashboard and pgadmin4 with custom port.

However, https://api.test-external.com:7070 is working fine but could not be able to get working for https://api.test-external.com:5050. Its showing ERR_SSL_PROTOCOL_ERROR

I have multiple services exposed in other ports. Can anyone Please help on how can i have enabled https in port 5050 like https://api.test-external.com:5050 or others port like (7800,4000).

docker-compose.yaml

version: "3.7"

services:
  reverse-proxy:
    image: traefik:v2.10
    command:
      - "--log.level=DEBUG"  
      - "--providers.docker"
      - "--api=true"
      - "--providers.docker.exposedByDefault=false"
      - "--accesslog=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web-secure.address=:443"
      - "--entrypoints.pgadmin4.address=:5050"
      - "--entrypoints.web.http.redirections.entryPoint.to=web-secure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--certificatesresolvers.lets-resolver.acme.email=xxx2@gmail.com"
      - "--certificatesresolvers.lets-resolver.acme.storage=/etc/traefik/acme/acme.json"
      - "--certificatesresolvers.lets-resolver.acme.dnschallenge=true"
      - "--certificatesresolvers.lets-resolver.acme.dnschallenge.provider=cloudflare"
      - "--certificatesresolvers.lets-resolver.acme.dnschallenge.delaybeforecheck=0"
    environment:
      - CF_API_EMAIL=xxx2@gmail.com
      - CF_DNS_API_TOKEN=token goes here
    ports:
      - "80:80"
      - "7070:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./letsencrypt/acme.json:/etc/traefik/acme/acme.json
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.reverse-proxy.entrypoints=web-secure"
      - "traefik.http.routers.reverse-proxy.rule=Host(`api.test-external.com`)"
      - "traefik.http.routers.reverse-proxy.tls=true"
      - "traefik.http.routers.reverse-proxy.tls.certresolver=lets-resolver"
      - "traefik.http.routers.reverse-proxy.service=api@internal"

    restart: always


  db:
    image: postgis/postgis:13-3.1-alpine
    env_file:
      .env
    volumes:
      - postgis:/var/lib/postgresql/data
    networks:
      - app-network
    ports:
      - '5432:5432'
    restart: always
    labels:
      - "traefik.enable=false"

  pgadmin4:
    image: dpage/pgadmin4
    container_name: pgadmin4
    ports:
        - '5050:80'
    environment:
        PGADMIN_DEFAULT_EMAIL: test@test.com
        PGADMIN_DEFAULT_PASSWORD: test
    links:
        - db
    networks:
      - app-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pgadmin4.entrypoints=pgadmin4"
      - "traefik.http.routers.pgadmin4.rule=Host(`api.test-external.com`)"
      - "traefik.http.routers.pgadmin4.tls=true"
      - "traefik.http.routers.pgadmin4.tls.certresolver=lets-resolver"
      - "traefik.http.routers.pgadmin4.service=pgadmin4"
    restart: always

networks:
  app-network:
    driver: bridge

volumes:
  postgis:
2

You can’t mix traefik.yml/toml and command, decide for one.

3

ok updating the questions then

4

You declare entrypoints with ports in Traefik, but then you do not expose those ports from the Traefik container, but instead on the target service/container. That’s probably a mistake.

5

Did you mean, i need to expose 5050 port in traefik container as well like following. you can not expose same port for two containers. Can you please briefly explain what did you mean?

    ports:
      - "80:80"
      - "7070:443"
      - "5050:80"
6

i would say the standard setting is that only Traefik exposes ports, no other service/container.

Instead the other services are connected to a Docker network and Traefik can forward requests internally, no open ports needed.

That way the services are only available via proxy, all Traefik (security) middlewares in place, no way to go around.

See simple Traefik example.

7

I have checked by exposing the port only in traefik container but still does not solve my problem

8

What does Traefik debug log tell you?