Swarm deployment: TLS settings needed on the router?

Traefik Traefik v3 (latest)
1

Hi,

Having already put tls settings at the command level:

command: # CLI arguments
  - --global.checkNewVersion=true
  - --global.sendAnonymousUsage=true
  - --entrypoints.web.address=:80
  - --entrypoints.web.http.redirections.entrypoint.to=websecure
  - --entrypoints.web.http.redirections.entrypoint.scheme=https
  - --entrypoints.web.http.redirections.entrypoint.permanent=true
  - --entryPoints.web.proxyProtocol.insecure=true
  - --entryPoints.web.forwardedHeaders.insecure=true
    #- --entrypoints.web.http.middlewares=traefik-bouncer@file
  - --entrypoints.websecure.address=:443
  - --entrypoints.websecure.http.tls=true
  - --entrypoints.websecure.http.tls.options=tls-opts@file
  - --entrypoints.websecure.http.tls.certresolver=dns-cloudflare
    #- --entrypoints.websecure.forwardedHeaders.trustedIPs=$CLOUDFLARE_IPS,$LOCAL_IPS
  - --entryPoints.websecure.forwardedHeaders.insecure=true
  - --entryPoints.websecure.proxyProtocol.insecure=true
    #- --entrypoints.websecure.http.middlewares=traefik-bouncer@file

I thought I would not need them on the labels (did not need them on previous docker deployment and on kubernetes deployment), but without them the certresolver would not start for the router's domain.

deploy:
  mode: replicated
  replicas: 1
  labels:
    - "org.label-schema.group=monitoring"
    - "traefik.enable=true"
    - "traefik.swarm.network=traefik"
    # HTTP Routers
    - "traefik.http.routers.traefik-router.entrypoints=websecure"
    - "traefik.http.routers.traefik-router.rule=Host(`traefik.domain.com`)"
    - "traefik.http.routers.traefik-router.tls=true"
    - "traefik.http.routers.traefik-router.tls.options=tls-opts@file"
    - "traefik.http.routers.traefik-router.tls.certresolver=dns-cloudflare"
    #Services - API
    - "traefik.http.routers.traefik-router.service=api@internal"
    - "traefik.http.services.traefik.loadbalancer.server.port=8080"
    # Middlewares
    - "traefik.http.routers.traefik-router.middlewares=secure-headers@file"

Is there something I am missing or is it a swarm thing?

Thank you.

2

Correct, no need for TLS on labels, best to handle it centrally.

Check simple Traefik Swarm examples (single, multiple with dnsChallenge).

3

That's what I knew, but apparently didn't work out till I added the labels... the cloudflare acme mechanism did not trigger.

Anyway, removed the deployment and re-deployed after some config clearing and it actually seems to work as expected. Probably a provider.swarm.watch=true helped in the way.

4

Watch defaults to true anyway, so that shouldn't make a difference (doc).

5

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.