SSL certificates for non exposed services

mick2k · September 18, 2023, 4:22pm

Hello!

I am having this issue that is literally blocking all my services since I had to move from nginx-proxy to traefik (due its greater scalability)
I do not manage to have ssl/https on non public exposed (with dns record on cloudflare) services

Is really weird because I have traefik.domain.com that has the padlock, meanwhile whoami.domain.com doesnt! I tried a lot of configs and looked everywhere, correctly configured cloudflare as provider both with zone token, then global api too..

Is literally whole days I am trying to make this work

  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
       proxy:
          ipv4_address: 172.25.0.2
    ports:
      - "80:80"
      - "443:443"
      - "853:853"
      - "25:25"
      - "465:465"
      - "993:993"
      - "4190:4190"
    environment:
      - CF_API_EMAIL=${CF_API_EMAIL}
      #- CF_DNS_API_TOKEN=${CF_API_TOKEN}
      - CF_API_KEY=${CF_API_KEY}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${DOCKER_VOLUMES_FOLDER}/traefik/traefik.yml:/traefik.yml:ro
      - ${DOCKER_VOLUMES_FOLDER}/traefik/acme.json:/acme.json
      - ${DOCKER_VOLUMES_FOLDER}/traefik/config.yml:/config.yml:ro
      - ${DOCKER_VOLUMES_FOLDER}/traefik/logs:/var/log/traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`traefik.domain.com`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_AUTH_STR}"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.domain.com`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.service=api@internal"
  whoami:
    image: "traefik/whoami:latest"
    container_name: "whoami"
    hostname: "whoami"
    user: "1000:1000"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.entrypoints=https"
      - "traefik.http.routers.whoami.tls=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.domain.com`)"
      - "traefik.http.services.whoami.loadbalancer.server.port=80"


    networks:
      proxy:
        ipv4_address: 172.25.0.20

this is my traefik.yml

api:
  dashboard: true
  debug: true

accessLog:
  filePath: "/var/log/access.log"

log:
  level: INFO
  format: json
  filePath: /var/log/traefik/traefik.log

accesslog:
   format: json
   filePath: /var/log/traefik/access.log

entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https

  # HTTPS endpoint, with domain wildcard
  https:
    address: :443
    http:
      tls:
        # Generate a wildcard domain certificate
        certResolver: cloudflare
        domains:
          - main: domain.com # change this to your proxy domain
            sans:
              - '*.domain.com' # change this to your proxy domain

  dot:
    address: ":853"
    
  smtp:
    address: ":25"

  smtp-ssl:
    address: ":465"

  imap-ssl:
    address: ":993"

  sieve:
    address: ":4190"


serversTransport:
  insecureSkipVerify: true

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    filename: /config.yml


certificatesResolvers:
  cloudflare:
    acme:
      email: cfmail@gmail.com
      storage: acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

Am I missing something? T_T

If i try to "force" https into the browser url i get NS_ERROR_CONNECTION_REFUSED and the classic page in which you have to click continue that the site is not safe

These are some traefik logs that should state that cloudflare and its api is working

{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"Trying to challenge certificate for domain [dns.domain.com] found in HostSNI rule","providerName":"cloudflare.acme","routerName":"adguard-https@docker","rule":"Host(`dns.domain.com`)","time":"2023-09-18T13:16:52Z"}
{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"Trying to challenge certificate for domain [bachelor.domain.com] found in HostSNI rule","providerName":"cloudflare.acme","routerName":"sorting_visualized_https@docker","rule":"Host(`bachelor.domain.com`)","time":"2023-09-18T13:16:52Z"}
{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"Trying to challenge certificate for domain [vault.domain.com] found in HostSNI rule","providerName":"cloudflare.acme","routerName":"vaultwarden-https@docker","rule":"Host(`vault.domain.com`)","time":"2023-09-18T13:16:52Z"}
{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"Looking for provided certificate(s) to validate [\"vault.domain.com\"]...","providerName":"cloudflare.acme","routerName":"vaultwarden-https@docker","rule":"Host(`vault.domain.com`)","time":"2023-09-18T13:16:52Z"}
{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"Looking for provided certificate(s) to validate [\"dns.domain.com\"]...","providerName":"cloudflare.acme","routerName":"adguard-https@docker","rule":"Host(`dns.domain.com`)","time":"2023-09-18T13:16:52Z"}
{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"Looking for provided certificate(s) to validate [\"bachelor.domain.com\"]...","providerName":"cloudflare.acme","routerName":"sorting_visualized_https@docker","rule":"Host(`bachelor.domain.com`)","time":"2023-09-18T13:16:52Z"}
{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"No ACME certificate generation required for domains [\"vault.domain.com\"].","providerName":"cloudflare.acme","routerName":"vaultwarden-https@docker","rule":"Host(`vault.domain.com`)","time":"2023-09-18T13:16:52Z"}
{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"No ACME certificate generation required for domains [\"dns.domain.com\"].","providerName":"cloudflare.acme","routerName":"adguard-https@docker","rule":"Host(`dns.domain.com`)","time":"2023-09-18T13:16:52Z"}
{"ACME CA":"https://acme-v02.api.letsencrypt.org/directory","level":"debug","msg":"No ACME certificate generation required for domains [\"bachelor.domain.com\"].","providerName":"cloudflare.acme","routerName":"sorting_visualized_https@docker","rule":"Host(`bachelor.domain.com`)","time":"2023-09-18T13:16:52Z"}

what buzzes me the most is that traefik.domain.com is https and working great without any public dns record on cloudflare

as internal dns resolver (for dns rewrites) i use adguardhome, quite common usecase and many also use PiHole too

bluepuma77 · September 19, 2023, 5:54am

Did you create the according sub-domains with correct IP or CNAME in DNS? Not all DNS resolvers support wildcards there.

mick2k · September 19, 2023, 7:29am

I just set the dns rewrites into adguardhome (pihole-like), nothing else

Shall I add A records on cloudflare that point to my private IP addresses? As I understood there are 3 options
-> DNS rewrites into local dns resovler
-> Add A records that point to container local ips
-> Edit the hosts file and add there the domains
For now I only tried the first one, seen some videos on yt that go for the third one, the second one feels a bit sketchy/wrong but i do not know really

bluepuma77 · September 19, 2023, 8:45am

Connection refused would indicate the browser is accessing the wrong domain or the returned IP (or port) is not reachable from your client.

You could check the acme.json file for the created Traefik LE certificates.

mick2k · September 19, 2023, 9:57am

This is all I did as configuration

and for traefik[dot]domain[dot]com is working great...
The acme has the domain.com and *.domain.com and seems fine to me

bluepuma77 · September 19, 2023, 10:03am

You always need to use the Traefik IP.

All requests from client need to go to Traefik, which will forward them to the matching service.

mick2k · September 19, 2023, 3:18pm

omg I fell so stupid, I was literally bypassing the reverse proxy! Forgot to delete these entries while migrating from nginx

Thank you so much

system · September 22, 2023, 3:18pm

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Need Help! Cloudflare: failed to find zone DOMAIN.net Traefik v2 docker , letsencrypt-acme	5	2703	March 28, 2023
Unable to access address outside home network Traefik v3 (latest) docker , letsencrypt-acme	0	38	July 26, 2024
Router uses a nonexistent certificate resolver LetsEncrypt/Cloudflare Traefik v3 (latest) docker , letsencrypt-acme	1	91	September 20, 2024
Problem with Lets Encrypt. ACME Fails Traefik v2 docker , letsencrypt-acme	3	3298	March 11, 2022
Setting up HTTPS with Lets Encrypt on Traefik and getting errors Traefik v2 docker , letsencrypt-acme	0	2200	March 13, 2020

SSL certificates for non exposed services

Related topics