Your example seems to work as expected, but my config is a bit more complicated. Here's a slightly redacted copy. Maybe you can spot my error? The "traefik:5" image is based on "traefik:1.7.30-alpine". The Dockerfile only adds certs and the traefik.toml file. The "traefik2:18" image adds the traefik.yml as well as sets up some secrets for ACME. I get different results depending on whether I use version 2.6.6 or 2.7.
When using 2.6.6, the "nginx3" service works correctly, but "nginx2" doesn't. The request for "traefik-test-nginx2.example.com" appears to reach the traefik1.7 instance and is redirected to https, at which point traefik2 returns a self signed cert and a 404.
When using 2.7, the "nginx2" service works correctly, but "nginx3" appears to also hit the traefik1.7 instance which throws a 404 along with a cert warning for the manually configured cert for nginx2
I know that this config probably seems convoluted, but we have a large number of services currently configured for traefik 1.7 wherein TLS is terminated at traefik, and the services are mostly configured for HTTPS redirect. I'd like to put traefik2 in front of 1.7 and pass through either HTTP or HTTPS traffic until each service is reconfigured for traefik2 by updating the labels.
Traefik docker-compose.yml:
version: '3.7'
configs:
traefik2-providers:
file: ../traefik2/traefik2-providers.yml
volumes:
data:
name: traefik-data
services:
traefik1:
image: traefik:5
command: --configFile=/etc/traefik/traefik.toml
ports:
- "80"
- "443"
- 8090:8090
deploy:
mode: global
update_config:
parallelism: 1
delay: 1m
failure_action: rollback
order: stop-first
healthcheck:
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8090/ping"]
interval: 20s
timeout: 10s
retries: 3
networks:
- traefik-net
volumes:
- type: bind
source: /var/run/docker.sock
target: /var/run/docker.sock
- type: volume
source: data
target: /var/log/traefik/
volume:
nocopy: true
traefik2:
image: traefik2:18
entrypoint: sh /usr/local/bin/entrypoint-overwrite.sh
ports:
# The HTTP port
- target: 80
published: 80
protocol: tcp
mode: host
- target: 443
published: 443
protocol: tcp
mode: host
- target: 8080
published: 8080
protocol: tcp
mode: host
deploy:
mode: global
labels:
- "traefik.enable=true"
- "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
- "traefik.http.routers.dashboard.service=api@internal"
- "traefik.http.routers.dashboard.entrypoints=dashboard"
- "traefik.http.middlewares.dashboard.ipwhitelist.sourcerange=10.17.44.0/24"
- "traefik.http.routers.dashboard.middlewares=dashboard,auth"
- "traefik.http.middlewares.auth.basicauth.usersfile=/run/secrets/traefik-dashboard-passwd"
# Dummy service for Swarm port detection. The port can be any valid integer value.
- "traefik.http.services.dummy-svc.loadbalancer.server.port=9999"
volumes:
# So that Traefik can listen to the Docker events
- /var/run/docker.sock:/var/run/docker.sock
configs:
- source: traefik2-providers
target: /etc/traefik/providers.yaml
networks:
- traefik-net
secrets:
- incommon-hmac
- traefik-dashboard-passwd
networks:
traefik-net:
external: true
secrets:
incommon-hmac:
external: true
traefik-dashboard-passwd:
external: true
traefik.yml:
log:
level: DEBUG
api:
dashboard: true
entryPoints:
web:
address: ":80"
forwardedHeaders:
websecure:
address: ":443"
forwardedHeaders:
dashboard:
address: ":8080"
providers:
docker:
swarmMode: true
file:
directory: /etc/traefik
filename: traefik2-providers.yml
certificatesResolvers:
letsencrypt:
acme:
caServer: https://acme-staging-v02.api.letsencrypt.org/directory
email: me@example.com
storage: acme.json
httpChallenge:
entryPoint: web
incommon:
acme:
caServer: https://acme.sectigo.com/v2/InCommonRSAOV
email: me@example.com
storage: acme.json
httpChallenge:
entryPoint: web
eab:
kid: <key_id>
hmacEncoded: hmacsecret
traefik-providers.yml:
# traefik2-providers.yaml
http:
routers:
# Define a catch-all router that forwards requests to legacy Traefik
to-traefik1:
# Catch all domains (regex matches all strings)
# See https://github.com/google/re2/wiki/Syntax
rule: "HostRegexp(`{domain:.+}`)"
entrypoints:
- "web"
# If the rule matches, forward to the traefik1 service (see below)
service: traefik1
# Set the lowest priority, so this route is only used as a last resort
priority: 1
services:
# Define how to reach legacy Traefik
traefik1:
loadBalancer:
servers:
# Legacy Traefik is part of the same stack so,
# hostname defaults to service name
- url: http://traefik1
tcp:
routers:
to-traefik1-https:
rule: "HostSNI(`*`)"
entrypoints:
- "websecure"
service: traefik1-https
tls:
passthrough: true
services:
traefik1-https:
loadBalancer:
servers:
- address: "traefik1:443"
traefik.toml:
InsecureSkipVerify = true
logLevel = "DEBUG"
defaultEntryPoints = ["https","http"]
[accessLog.fields]
defaultMode = "keep"
[entryPoints]
#[entryPoints.traefik]
#address = ":8090"
[entryPoints.ping]
address = ":8090"
[entryPoints.http]
address = ":80"
compress = true
[entryPoints.http.proxyProtocol]
insecure = true
[entryPoints.http.forwardedHeaders]
insecure = true
[entryPoints.https]
address = ":443"
compress = true
[entryPoints.https.tls]
minVersion = "VersionTLS11"
[[entryPoints.https.tls.certificates]]
certFile = "/etc/ssl/certs/server.cer"
keyFile = "/etc/ssl/certs/server.key"
[entryPoints.https.proxyProtocol]
insecure = true
[entryPoints.https.forwardedHeaders]
insecure = true
[ping]
entryPoint = "ping"
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "docker.localhost"
watch = true
swarmmode = true
nginx2 docker-compose.yml:
version: "3"
services:
client:
image: nginx
environment:
- PORT=80
#ports:
# - 8000:80
volumes:
- ./src:/usr/share/nginx/html
networks:
- traefik-net
deploy:
labels:
- traefik.enable=true
- "traefik.docker.network=traefik-net"
- "traefik.port=80"
- "traefik.frontend.rule=Host:traefik-test-nginx2.example.com"
- "traefik.frontend.passHostHeader=true"
- "traefik.backend.loadbalancer.stickiness=true"
- "traefik.frontend.redirect.entryPoint=https"
networks:
traefik-net:
external: true
nginx3 docker-compose.yml:
version: "3"
services:
client:
image: nginx
environment:
- PORT=80
#ports:
# - 8000:80
volumes:
- ./src:/usr/share/nginx/html
networks:
- traefik-net
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.nginx3.entrypoints=web
- traefik.http.routers.nginx3.rule=Host(`traefik-test-nginx3.example.com`)
- traefik.http.services.nginx3-svc.loadbalancer.server.port=80
- traefik.http.routers.nginx3.middlewares=https-redirect
- traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
- traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
- traefik.http.routers.nginx3-secure.tls=true
- traefik.http.routers.nginx3-secure.tls.certresolver=incommon
- traefik.http.routers.nginx3-secure.entrypoints=websecure
- traefik.http.routers.nginx3-secure.rule=Host(`traefik-test-nginx3.example.com`)
networks:
traefik-net:
external: true