Here is the inspection of my docker container after the change
ronin@ninjaserver:~/docker-traefik-letsencrypt$ docker service inspect traefik_traefik
[
{
"ID": "cjm16392lxu45jfu5zddb8gd6",
"Version": {
"Index": 65499
},
"CreatedAt": "2020-11-11T21:33:20.982361515Z",
"UpdatedAt": "2020-11-11T21:33:22.184796102Z",
"Spec": {
"Name": "traefik_traefik",
"Labels": {
"com.docker.stack.image": "traefik:2.3.2",
"com.docker.stack.namespace": "traefik",
"constraint-label": "reverse-proxy",
"traefik.docker.network": "reverse-proxy",
"traefik.enable": "true",
"traefik.http.middlewares.admin-auth.basicauth.users": "admin:$apr1$U1rooPiN$2uZapgnnZh./6ZBB9WTYq/",
"traefik.http.routers.reverse-proxy-https.entrypoints": "web,web-secure",
"traefik.http.routers.reverse-proxy-https.middlewares": "admin-auth",
"traefik.http.routers.reverse-proxy-https.rule": "Host(`traefik.whiskeyonthe.rocks`)",
"traefik.http.routers.reverse-proxy-https.service": "api@internal",
"traefik.http.routers.reverse-proxy-https.tls": "true",
"traefik.http.routers.reverse-proxy-https.tls.certresolver": "le",
"traefik.http.routers.reverse-proxy.tls.domains[0].main": "whiskeyonthe.rocks",
"traefik.http.routers.reverse-proxy.tls.domains[0].sans": "*.whiskeyonthe.rocks",
"traefik.http.services.reverse-proxy.loadbalancer.server.port": "8080"
},
"TaskTemplate": {
"ContainerSpec": {
"Image": "traefik:2.3.2@sha256:6e6d4dc5a19afe06778ca092cdbbb98e31cb9f9c313edafa23f81a0e6ddf8a23",
"Labels": {
"com.docker.stack.namespace": "traefik"
},
"Args": [
"--accesslog",
"--log",
"--log.level=DEBUG",
"--api",
"--providers.docker",
"--providers.docker.constraints=Label(`constraint-label`, `reverse-proxy`)",
"--providers.docker.exposedbydefault=false",
"--providers.docker.swarmmode",
"--entrypoints.web.address=:80",
"--entrypoints.web.http.redirections.entryPoint.to=web-secure",
"--entrypoints.web.http.redirections.entrypoint.scheme=https",
"--entrypoints.web-secure.address=:443",
"--certificatesresolvers.le.acme.email=admin@whiskeyonthe.rocks",
"--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json",
"--certificatesresolvers.le.acme.tlschallenge=true"
],
"Env": [
"DOMAIN=traefik.whiskeyonthe.rocks",
"EMAIL=admin@whiskeyonthe.rocks",
"EXTRA_HOSTS=\"traefik.whiskeyonthe.rocks:185.193.127.125\"",
"HASHED_PASSWORD='$apr1$6XaPhlNf$N.NgCREOAXsVNmV8IKk//w.'",
"NODE_ID=63glxibxvxp4wvqpyrvnndvjt",
"PASSWORD=\"changethis\"",
"SRV_VPATH=\"/srv/traefik.whiskeyonthe.rocks/\"",
"USERNAME=admin"
],
"Privileges": {
"CredentialSpec": null,
"SELinuxContext": null
},
"Mounts": [
{
"Type": "bind",
"Source": "/var/run/docker.sock",
"Target": "/var/run/docker.sock",
"ReadOnly": true
},
{
"Type": "bind",
"Source": "/srv/traefik.whiskeyonthe.rocks/certs",
"Target": "/certificates"
},
{
"Type": "bind",
"Source": "/srv/traefik.whiskeyonthe.rocks/letsencrypt",
"Target": "/letsencrypt"
}
],
"StopGracePeriod": 10000000000,
"DNSConfig": {},
"Isolation": "default"
},
"Resources": {
"Limits": {
"NanoCPUs": 500000000,
"MemoryBytes": 536870912
},
"Reservations": {
"NanoCPUs": 250000000,
"MemoryBytes": 268435456
}
},
"RestartPolicy": {
"Condition": "any",
"Delay": 5000000000,
"MaxAttempts": 0
},
"Placement": {
"Constraints": [
"node.labels.reverse-proxy.reverse-proxy-certificates == true",
"node.role == manager"
],
"Platforms": [
{
"Architecture": "amd64",
"OS": "linux"
},
{
"OS": "linux"
},
{
"Architecture": "arm64",
"OS": "linux"
}
]
},
"Networks": [
{
"Target": "fqtnk83r8sgi2toz0vb6macvz",
"Aliases": [
"traefik"
]
}
],
"ForceUpdate": 0,
"Runtime": "container"
},
"Mode": {
"Replicated": {
"Replicas": 1
}
},
"UpdateConfig": {
"Parallelism": 1,
"FailureAction": "pause",
"Monitor": 5000000000,
"MaxFailureRatio": 0,
"Order": "stop-first"
},
"RollbackConfig": {
"Parallelism": 1,
"FailureAction": "pause",
"Monitor": 5000000000,
"MaxFailureRatio": 0,
"Order": "stop-first"
},
"EndpointSpec": {
"Mode": "vip",
"Ports": [
{
"Protocol": "tcp",
"TargetPort": 80,
"PublishedPort": 80,
"PublishMode": "ingress"
},
{
"Protocol": "tcp",
"TargetPort": 443,
"PublishedPort": 443,
"PublishMode": "ingress"
}
]
}
},
"Endpoint": {
"Spec": {
"Mode": "vip",
"Ports": [
{
"Protocol": "tcp",
"TargetPort": 80,
"PublishedPort": 80,
"PublishMode": "ingress"
},
{
"Protocol": "tcp",
"TargetPort": 443,
"PublishedPort": 443,
"PublishMode": "ingress"
}
]
},
"Ports": [
{
"Protocol": "tcp",
"TargetPort": 80,
"PublishedPort": 80,
"PublishMode": "ingress"
},
{
"Protocol": "tcp",
"TargetPort": 443,
"PublishedPort": 443,
"PublishMode": "ingress"
}
],
"VirtualIPs": [
{
"NetworkID": "pmeaxo2xvkulmkmjc4l2ow0z8",
"Addr": "10.0.0.12/24"
},
{
"NetworkID": "fqtnk83r8sgi2toz0vb6macvz",
"Addr": "10.0.2.31/24"
}
]
}
}
]
docker-compose.yml
ronin@ninjaserver:~/docker-traefik-letsencrypt$ cat docker-compose.yml
version: '3.7'
services:
traefik:
image: traefik:2.3.2
ports:
- "80:80"
- "443:443"
deploy:
resources:
limits:
cpus: '0.50'
memory: 512M
reservations:
cpus: '0.25'
memory: 256M
placement:
constraints:
# Make the traefik service run only on the node with this label
# as the node with it has the volume for the certificates
- node.labels.reverse-proxy.reverse-proxy-certificates == true
- node.role == manager
labels:
- constraint-label=reverse-proxy
- traefik.enable=true
- traefik.docker.network=reverse-proxy
- traefik.http.middlewares.admin-auth.basicauth.users=${USERNAME}:${HASHED_PASSWORD}
- traefik.http.routers.reverse-proxy-https.rule=Host(`${DOMAIN}`)
- traefik.http.routers.reverse-proxy-https.entrypoints=web,web-secure
- traefik.http.routers.reverse-proxy-https.tls=true
- traefik.http.routers.reverse-proxy-https.service=api@internal
- traefik.http.routers.reverse-proxy-https.tls.certresolver=le
- traefik.http.routers.reverse-proxy-https.middlewares=admin-auth
- traefik.http.routers.reverse-proxy.tls.domains[0].main=whiskeyonthe.rocks
- traefik.http.routers.reverse-proxy.tls.domains[0].sans=*.whiskeyonthe.rocks
- traefik.http.services.reverse-proxy.loadbalancer.server.port=8080
volumes:
# Add Docker as a mounted volume, so that Traefik can read the labels of other services
- "/var/run/docker.sock:/var/run/docker.sock:ro"
# Mount the volume to store the certificates
- "/srv/traefik.whiskeyonthe.rocks/certs:/certificates"
- "/srv/traefik.whiskeyonthe.rocks/letsencrypt:/letsencrypt"
#- "reverse-proxy-certificates:/certificates"
#- "reverse-proxy-certificates:/letsencrypt"
command:
- --accesslog
- --log
- --log.level=DEBUG
- --api
- --providers.docker
- --providers.docker.constraints=Label(`constraint-label`, `reverse-proxy`)
- --providers.docker.exposedbydefault=false
- --providers.docker.swarmmode
- --entrypoints.web.address=:80
# global redirect to https
- --entrypoints.web.http.redirections.entryPoint.to=web-secure
- --entrypoints.web.http.redirections.entrypoint.scheme=https
- --entrypoints.web-secure.address=:443
- --certificatesresolvers.le.acme.email=${EMAIL}
- --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
- --certificatesresolvers.le.acme.tlschallenge=true
#- --certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
networks:
# Use the public network created to be shared between Traefik and
# any other service that needs to be publicly available with HTTPS
- reverse-proxy
extra_hosts:
- EXTRA_HOSTS
environment:
- NODE_ID=54fsdfdsfsdfsdfsfsdf
- EMAIL=admin@whiskeyonthe.rocks
- DOMAIN=traefik.whiskeyonthe.rocks
- USERNAME=admin
- PASSWORD="changethis"
- HASHED_PASSWORD='$$apr1$$6XaPhlNf$$N.NgCREOAXsVNmV8IKk//w.'
#- HASHPASS_ENV: $(HASHPASS_HOST:~(openssl passwd -apr1 $PASSWORD))
#- $SRV_VPATH="/srv/DOMAIN.TLD/"
- EXTRA_HOSTS="traefik.whiskeyonthe.rocks:185.193.127.125"
env_file:
- ./.env
whoami:
image: "traefik/whoami"
container_name: "simple-service"
labels:
- "traefik.enable=true"
- "traefik.http.routers.whoami.rule=Host(`whoami.whiskeyonthe.rocks`)"
- "traefik.http.routers.whoami.middlewares=auth"
- "traefik.http.routers.whoami.entrypoints=web,web-secure"
- "traefik.http.routers.whoami.tls.certresolver=le"
networks:
- reverse-proxy
volumes:
# Create a volume to store the certificates, there is a constraint to make sure
# Traefik is always deployed to the same Docker node with the same volume containing
# the HTTPS certificates
reverse-proxy-certificates:
networks:
# Use the previously created public network "reverse-proxy", shared with other
# services that need to be publicly available via this Traefik
reverse-proxy:
external: true
driver: overlay
Error logs
ronin@ninjaserver:~$ docker service logs traefik_traefik -f --no-trunc | grep -i error
traefik_traefik.1.87i0qkhi00evxli7mc0bnrq5r@ninjaserver | time="2020-11-11T22:29:43Z" level=error msg="Unable to obtain ACME certificate for domains \"traefik.whiskeyonthe.rocks\": unable to generate a certificate for the domains [traefik.whiskeyonthe.rocks]: error: one or more domains had a problem:\n[traefik.whiskeyonthe.rocks] acme: error: 400 :: urn:ietf:params:acme:error:connection :: Connection refused, url: \n" providerName=le.acme routerName=reverse-proxy-https@docker rule="Host(`traefik.whiskeyonthe.rocks`)"
ports
ronin@ninjaserver:~/docker-traefik-letsencrypt$ sudo ss -tnlp
[sudo] password for ronin:
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:* users:(("systemd-resolve",pid=143,fd=13))
LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=216,fd=3))
LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=216,fd=4))
LISTEN 0 128 *:443 *:* users:(("dockerd",pid=214,fd=55))
LISTEN 0 128 *:9001 *:* users:(("docker-proxy",pid=1080,fd=4))
LISTEN 0 128 *:2377 *:* users:(("dockerd",pid=214,fd=16))
LISTEN 0 128 *:7946 *:* users:(("dockerd",pid=214,fd=29))
LISTEN 0 128 *:80 *:* users:(("dockerd",pid=214,fd=54))
ronin@ninjaserver:~/docker-traefik-letsencrypt$ sudo netstat -tnlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 143/systemd-resolve
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 216/sshd: /usr/sbin
tcp6 0 0 :::22 :::* LISTEN 216/sshd: /usr/sbin
tcp6 0 0 :::443 :::* LISTEN 214/dockerd
tcp6 0 0 :::9001 :::* LISTEN 1080/docker-proxy
tcp6 0 0 :::2377 :::* LISTEN 214/dockerd
tcp6 0 0 :::7946 :::* LISTEN 214/dockerd
tcp6 0 0 :::80 :::* LISTEN 214/dockerd
