Hello,
A few weeks ago, I switched from Nginx to Traefik as a proxy for my personal needs (around 10 to 15 containers).
In normal mode, everything works very well. However, I do daily updates, and on these occasions, I stop all my containers, do pull updates, and restart them. And almost every time, I have one (or two or three) applications that are no longer accessible even though the containers are running correctly.
I have to restart these (sometimes multiple times) for everything to get back to normal. And I also notice that by doing this, sometimes another service (also behind Traefik) stops working even though I haven't touched it.
Given Traefik's reputation, I imagine the problem comes from my configuration, but I don't know where to look (I have nothing in the logs).
Here is my traefik configuration:
command:
- --api.dashboard=true
- --providers.docker=true
- --providers.docker.exposedbydefault=false
- --entryPoints.web.address=:80
- --entrypoints.web.http.redirections.entrypoint.to=websecure
- --entrypoints.web.http.redirections.entrypoint.scheme=https
- --entrypoints.web.http.redirections.entrypoint.permanent=true
- --entryPoints.websecure.address=:443
- --entryPoints.websecure.http.tls=true
- --certificatesresolvers.letsencrypt.acme.httpchallenge=true
- --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
- --certificatesresolvers.letsencrypt.acme.email=
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
labels:
- traefik.enable=true
- traefik.http.routers.api.rule=
- traefik.http.routers.api.service=api@internal
- traefik.http.routers.api.entrypoints=websecure
- traefik.http.routers.api.tls=true
- traefik.http.routers.api.tls.certresolver=letsencrypt
- traefik.http.routers.api.middlewares=auth
- traefik.http.middlewares.auth.basicauth.users=
- traefik.tls.options.default.minVersion=VersionTLS13
- traefik.tls.options.default.sniStrict=true
- traefik.http.middlewares.security-headers.headers.accessControlAllowMethods=GET, OPTIONS, PUT
- traefik.http.middlewares.security-headers.headers.accessControlMaxAge=100
- traefik.http.middlewares.security-headers.headers.SSLRedirect=true
- traefik.http.middlewares.security-headers.headers.STSSeconds=31536000
- traefik.http.middlewares.security-headers.headers.STSIncludeSubdomains=true
- traefik.http.middlewares.security-headers.headers.STSPreload=true
- traefik.http.middlewares.security-headers.headers.forceSTSHeader=true
- traefik.http.middlewares.security-headers.headers.frameDeny=true
- traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true
- traefik.http.middlewares.security-headers.headers.browserXSSFilter=true
- traefik.http.middlewares.security-headers.headers.referrerPolicy=same-origin
Do you have any idea?
Thank you.
David.