How to disable http redirect to https for a single container domain?

fl0wfr · September 15, 2020, 9:09am

Hi,

I'm trying to configure a Poste.io container using Let's Encrypt for SMTPS/IMAPS, but everytime I try to generate a certificate from Poste.io UI, I got an error. I check the generated ACME URL but Traefik keeps redirecting to HTTPS, which should cause the error.
Here is my Poste.io conf (sorry, I don't use Docker Compose):

docker run -d --name poste.io --restart=unless-stopped --hostname=mail.domain.tld -p 25:25 -p 8084:80 -p 110:110 -p 143:143 -p 465:465 -p 587:587 -p 993:993 -p 995:995 -p 11443:443 -v /etc/localtime:/etc/localtime:ro -v /docker/Poste.io:/data \
-l "traefik.enable=true" \
-l "traefik.http.routers.webmail.rule=Host(\`webmail.domain.tld\`)" \
-l "traefik.http.routers.webmail.service=webmail" \
-l "traefik.http.routers.webmail.entrypoints=https,http" \
-l "traefik.http.routers.webmail.tls=true" \
-l "traefik.http.routers.webmail.tls.options=default" \
-l "traefik.http.routers.webmail.tls.certresolver=xxx" \
-l "traefik.http.services.webmail.loadbalancer.server.port=80" \
-l "traefik.http.routers.webmail.middlewares=https-redirect@file,security-headers@file" \
-l "traefik.http.routers.webmail-insecure.rule=Host(\`webmail.domain.tld\`)" \
-l "traefik.http.routers.webmail-insecure.middlewares=https-redirect@file,security-headers@file" \
-l "traefik.http.routers.posteio.rule=Host(\`posteio.domain.tld\`)" \
-l "traefik.http.routers.posteio.service=posteio" \
-l "traefik.http.routers.posteio.entrypoints=https,http" \
-l "traefik.http.routers.posteio.tls=true" \
-l "traefik.http.routers.posteio.tls.options=default" \
-l "traefik.http.routers.posteio.tls.certresolver=xxx" \
-l "traefik.http.services.posteio.loadbalancer.server.port=80" \
-l "traefik.http.routers.posteio.middlewares=https-redirect@file,security-headers@file" \
-l "traefik.http.routers.posteio-insecure.rule=Host(\`posteio.domain.tld\`)" \
-l "traefik.http.routers.posteio-insecure.middlewares=https-redirect@file,security-headers@file" \
-l "traefik.http.middlewares.posteio.redirectregex.regex=posteio.domain.tld/webmail" \
-l "traefik.http.middlewares.posteio.redirectregex.replacement=posteio.domain.tld/admin/" \
-l "traefik.http.routers.leposte.service=leposte" \
-l "traefik.leposte.frontend.rule=HostRegexp(\`mail.domain.tld\`) && PathPrefix(\`/.well-known/\`)" \
-l "traefik.http.services.leposte.loadbalancer.server.port=80" \
-l "traefik.http.routers.leposte.entrypoints=http" \
-l "traefik.http.routers.leposte.tls=false" \
-e "HTTPS=OFF" -e "HOSTNAME=mail.domain.tld" -t analogic/poste.io

And traefil.toml:

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"

[api]
  insecure = true

[providers.docker]
  endpoint = "unix:///var/run/docker.sock"
  watch = true
  exposedByDefault = false
  swarmMode = false

[providers.file]
  filename = "/etc/traefik/services.toml"

[certificatesResolvers.xxx.acme]
  email = "xxx@domain.tld"
  storage = "/etc/traefik/acme.json"
  [certificatesResolvers.xxx.acme.dnsChallenge]
    provider = "xxx"

[log]
  filePath = "/logs/traefik.log"

[accessLog]
  filePath = "/logs/access.log"

[metrics]
  [metrics.prometheus]

services.toml:

[http]
  [http.middlewares.auth.basicAuth]
    users = ["xxx:xxx"]
  [http.middlewares.https-redirect.redirectscheme]
    scheme = "https"
  [http.middlewares.security-headers.headers]
    AccessControlAllowMethods = ["GET", "OPTIONS", "PUT"]
    AccessControlAllowOrigin = "origin-list-or-null"
    AccessControlMaxAge = 100
    ForceSTSHeader = true
    BrowserXssFilter = true
    ContentTypeNosniff = true
    FrameDeny = true
    SSLRedirect = true
    STSIncludeSubdomains = true
    STSPreload = true
    STSSeconds = 31536000 
#    ContentSecurityPolicy = "default-src 'self' 'unsafe-inline'"
    CustomFrameOptionsValue = "SAMEORIGIN"
    ReferrerPolicy = "same-origin"
    FeaturePolicy = "vibrate 'self'"

  [http.routers]
    [http.routers.nvr]
      entrypoints = ["https"]
      rule = "Host(`nvr.domain.tld`)"
      service = "nvr"
      [http.routers.nvr.tls]
        certresolver = "xxx" 

  [http.services]
    [http.services.nvr.loadBalancer]
      [[http.services.nvr.loadBalancer.servers]]
        url = "http://XXX.XXX.XXX.XXX:XXX"

[tls.options]
  [tls.options.default]
    minVersion = "VersionTLS12"
    sniStrict = true
    cipherSuites = [
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
      "TLS_AES_128_GCM_SHA256",
      "TLS_AES_256_GCM_SHA384",
      "TLS_CHACHA20_POLY1305_SHA256",
      "TLS_FALLBACK_SCSV" # Client is doing version fallback. See RFC 7507.
    ]

Any help would be much appreciated
Best,

zespri · September 15, 2020, 10:25am

It might be helpful to post the error. Or even better the entire log file (enable debug logging first, if long, use something like gist).

I check the generated ACME URL but Traefik keeps redirecting to HTTPS, which should cause the error

This does not make sense to me. What is "ACME URL"? How is traefik redirection relevant with DNS challenge?

fl0wfr · September 15, 2020, 5:32pm

The error comes from Poste.io, it's simply because the ACME http URL is redirected by Traefik to https.
ACME is used for Poste.io certificate generation for SMTPS and IMAPS like I explained in first post.

zespri · September 15, 2020, 8:17pm

ACME is used for Poste.io certificate generation for SMTPS and IMAPS like I explained in first post.

It sounds like you are not using traefik for generating these certs then.

In my mail server setup I use traefik for all certificate generating needs, I then extract them from acme.json with a script and copy them to wherever they are used by SMTPS/IMAPS. You might consider doing the same. In my mind it's much cleaner approach then spreading certs management between different pieces of software.

As for redirection, I don't think there is an option to exclude a single container, but if you configure this for every container separately/individually, then you can configure this one not to redirect, and the rest to redirect, if that's what you like.

fl0wfr · September 15, 2020, 9:05pm

I never said that I used Traefik for LE certificate generation in this case.
Poste.io offers an embedded feature to generate the certificate, and it worked perfectly with Traefik v1, that's why I'm asking for help...
How can I disable redirection for this container? (You can notice that the title of the topic...)

zespri · September 15, 2020, 9:07pm

Last paragraph of my previous message addresses this.

ldez · September 15, 2020, 11:46pm

In fact, it's possible for a router, by playing with priority: if the router has a higher priority than the router with the redirection, the router will be excluded from the redirection.

example 1

version: '3.7'

services:

  # curl -L -k http://traefik.localhost (redirect to https://traefik.localhost)
  # curl http://whoami.localhost (no redirection)
  # curl -L -k http://example.localhost (redirect to https://example.localhost)

  traefik:
    image: traefik:v2.2
    command:
      - --log.level=INFO
      - --api
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      traefik.enable: 'true'

      # Dashboard
      traefik.http.routers.traefik.rule: Host(`traefik.localhost`)
      traefik.http.routers.traefik.entrypoints: websecure
      traefik.http.routers.traefik.tls: 'true'
      traefik.http.routers.traefik.service: api@internal

      # global redirect to https
      traefik.http.routers.http-catchall.rule: hostregexp(`{host:.+}`)
      traefik.http.routers.http-catchall.entrypoints: web
      traefik.http.routers.http-catchall.middlewares: redirect-to-https
      traefik.http.routers.http-catchall.priority: 1000

      # middleware redirect
      traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https

  whoami:
    image: containous/whoami:v1.5.0
    labels:
      traefik.enable: 'true'

      traefik.http.routers.aaa.rule: Host(`whoami.localhost`)
      traefik.http.routers.aaa.entrypoints: web
      traefik.http.routers.aaa.priority: 2000

      traefik.http.routers.bbb.rule: Host(`example.localhost`)
      traefik.http.routers.bbb.entrypoints: websecure

example 2

version: '3.7'

services:

  # curl -L -k http://traefik.localhost (redirect to https://traefik.localhost)
  # curl http://whoami.localhost (no redirection)
  # curl -L -k http://example.localhost (redirect to https://example.localhost)

  traefik:
    image: traefik:v2.2.10
    command:
      - --log.level=INFO
      - --api
      - --providers.docker.exposedbydefault=false
      
      - --entrypoints.web.address=:80
      # global redirect to https
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.priority=1000

      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls=true
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      traefik.enable: 'true'

      # Dashboard
      traefik.http.routers.traefik.rule: Host(`traefik.localhost`)
      traefik.http.routers.traefik.entrypoints: web,websecure
      traefik.http.routers.traefik.service: api@internal

  whoami:
    image: containous/whoami:v1.5.0
    labels:
      traefik.enable: 'true'

      traefik.http.routers.aaa.rule: Host(`whoami.localhost`)
      traefik.http.routers.aaa.entrypoints: web
      traefik.http.routers.aaa.priority: 2000

      traefik.http.routers.bbb.rule: Host(`example.localhost`)
      traefik.http.routers.bbb.entrypoints: web,websecure

system · September 18, 2020, 11:46pm

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Http to https redirection using docker-compose and letsencrypt http challenge Traefik v2 docker , letsencrypt-acme , middleware	0	482	September 2, 2021
Cannot get http -> https redirect to work properly Traefik v2 docker , middleware	3	1864	December 12, 2019
Traefik https redirection redirects to IP instead of Domain Traefik v2 docker , letsencrypt-acme	3	2894	May 13, 2021
HTTP to HTTPS redirect for single service not working Traefik v3 (latest) docker-swarm , letsencrypt-acme	4	32	October 17, 2024
Redirect to https not working Traefik v2 docker , letsencrypt-acme , middleware	3	2107	December 6, 2019

How to disable http redirect to https for a single container domain?

Related topics