Issue certificate using dns-01 challenge with Traefik

[lonix]

I want Traefik to get a wildcard certificate for my domain.

A basic docker-composel.yml without anything unnecessary:

services:
  traefik:
    image: traefik:v2.10.1
    container_name: traefik
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt/:/letsencrypt/
    ports:
      - 80:80
      - 443:443
    networks:
      - traefik
    environment:
      - "GANDIV5_API_KEY=..."
      - "LEGO_DISABLE_CNAME_SUPPORT=true"
    command:
      - --log.level=DEBUG
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=gandiv5
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesresolvers.letsencrypt.acme.email=me@example.com
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    labels:
      - "traefik.http.routers.wildcard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.wildcard.tls.domains[0].main=example.com"
      - "traefik.http.routers.wildcard.tls.domains[0].sans=*.example.com"

networks:
  traefik:

(I have separate compose files for services on that docker network.)

The logs have no errors, and there is no attempt to issue a certificate.

[bluepuma77]

When using

@lonix

--providers.docker.exposedbydefault=false

in static config, you also need

- traefik.enable=true

in your dynamic config labels.

[lonix]

Thanks that worked!

I thought that setting was only needed on other containers that rely on traefik, didn't realise it's also needed on the traefik container itself.

[bluepuma77]

Yes, you need it for the labels to be recognized.