# Traefik Configuration LetsEncrypt/Router + general issues TOML vs YAML vs CLI

**URL:** <https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme\
**Created:** [January 18, 2020, 6:33am UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969 "2020-01-18T06:33:26Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![UnspecifiedId](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/unspecifiedid/32/8649_2.png) [@UnspecifiedId](https://community.traefik.io/u/UnspecifiedId)\
**Post date:** [January 18, 2020, 6:33am UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969/1 "2020-01-18T06:33:26Z")

</div>

Greetings all,

Using Traefik 2.1.1

I'm really struggling with Traefik 2.x (or maybe life in general ;-)) and the syntax for TOML, YAML and CLI configurations.

Issues:  
#1. I'm uncertain when to use `'" when specifying domains in the various configuration. I believe ` in the YAML file in the labels and CLI section. ' in TOML is that correct?  
#2. Output not being written to all log files - traefikaccess.log works but traefik.log does not. Identical configuration yields different results. I have also tried moving traefik.log into the [log] section  
#3. LetsEncrypt not generating certificates for the host or other docker containers. Self-generated certificates do get served.

Configuration as below. Any guidance or a complete TOML working example would be greatly appreciated.

```auto

traefik-forum.yml file
version: '3.3'
services:
  traefik:
    image: traefik:v2.1.1
    container_name: my_traefik-monitor
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    environment:
      - TZ=Australia/Brisbane   
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /mnt/nas/docker/compose/traefik/traefik.toml:/traefik.toml:ro
      - /mnt/nas/logs/traefik:/logs
      - /mnt/nas/letsencrypt/acme.json:/letsencrypt/acme.json:rw
    labels:
      # Global settings
      - "traefik.enable=true"
      #- "traefik.log.filepath=/logs/traefik.log"
      #- "traefik.log.level=DEBUG"     
      #http router
      #- "traefik.http.routers.traefik.entrypoints=http"
      #- "traefik.http.routers.traefik.rule=Host(`monitor.mydomain.com`)"
     # - "traefik.http.middlewares.traefik-auth.basicauth.users=traefikadmin:$$2y$$05$$AAHlxk8PZExh/FilidNtF.YLpLYrJYZutxhDs8s30lCIClhOJINYi"
     # - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
     # - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
     # - traefik.http.routers.traefik.service=api@internal
     # - "traefik.http.routers.traefik-secure.entrypoints=https"
     # - "traefik.http.routers.traefik-secure.rule=Host(`monitor.mydomain.com`)"
     # - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
     # - "traefik.http.routers.traefik-secure.tls=true"
     # - "traefik.http.routers.traefik-secure.tls.certresolver=http"
     # - "traefik.http.routers.traefik-secure.service=api@internal"
      #- "traefik.http.services.loadbalancer.server.port=443"
networks:
  proxy:
    external: true

```

**Toml File:**

```auto
[global]
  checkNewVersion=true

[entryPoints]
  [entryPoints.http]
    address = ":80"
    
  [entryPoints.https]
    address = ":443"

[api]
  dashboard = true
  debug = true
  insecure=true

#[retry]

[log]
  level = "DEBUG"

[traefiklog]
  filePath="/logs/traefik.log"
  format="json"

[accesslog]
  filePath="/logs/traefikaccess.log"
  format="json"

[accessLog.filters]
    statusCodes = ["200", "300-302"]
    retryAttempts = true
    minDuration = "10ms"

  [accessLog.fields]
    defaultMode = "keep"
    [accessLog.fields.names]
      "ClientUsername" = "drop"

    [accessLog.fields.headers]
      defaultMode = "keep"
      [accessLog.fields.headers.names]
        "User-Agent" = "redact"
        "Authorization" = "drop"
        "Content-Type" = "keep"

[providers.docker]
  endpoint = "unix:///var/run/docker.sock"
  exposedByDefault=false
  network="proxy"

[http.routers]
  [http.routers.api]
    rule = "Host('monitor.mydomain.com')"
    entrypoints = ["dashboard"]
    service = "api@internal"

    [http.routers.api.tls]
        certResolver = "letsencrypt"
        [[http.routers.api.tls.domains]]
          main = "monitor.mydomain.com"
          
  [http.routers.traefik]
    entryPoints = ['http'] 
    rule = "Host('monitor.mydomain.com')"
    middlewares = ["traefik-https-redirect"]
    service = "traefik"
    [http.routers.traefik.tls]
      certResolver = "letsencrypt"
      [[http.routers.traefik.tls.domains]]
        main = "mydomain.com" # have tried also monitor.mydom.com                                                                                                                                                                                                                    
        sans = ["taps.mydomain.com","pipes.mydomain.com", "monitor.mydomain.com", "portainer.mydomain.com", "storm.mydomain.com","cloud.mydomain.com","pump.mydomain.com"]
 
  [http.routers.traefik-secure]
    entryPoints = ['https']
    rule = "Host('monitor.mydomain.com')"
    middlewares = ["traefik-basic-auth"]
    service = "traefik"
    [http.routers.traefik-secure.tls]
      certResolver = "letsencrypt"
      [[http.routers.traefik-secure.tls.domains]]
        main = "mydomain.com"
        sans = ["taps.mydomain.com","pipes.mydomain.com", "monitor.mydomain.com", "portainer.mydomain.com", "storm.mydomain.com","cloud.mydomain.com"]

[http.middlewares]
  [http.middlewares.traefik-basic-auth]
    users = ["traefikadmin:$$2y$$05$$AAHlxk8PZExh/FilidNtF.YLpLYrJYZutxhDs8s30lCIClhOJINYi"]
  [http.middlewares.traefik-https-redirect.redirectScheme]
    scheme = "https" 
    permanent = "true"

#[certificatesResolvers]
# [certificatesResolvers.letsencrypt]
 [certificatesResolvers.letsencrypt.acme]
  email = "mydomain@protonmail.com"
  storage = "/letsencrypt/acme.json"

 [certificateResolvers.letsencrypt.acme.tlsChallenge]
    entryPoint = "http"

```

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [January 18, 2020, 11:46am UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969/2 "2020-01-18T11:46:03Z")

</div>

Hello,

in the v2, the dynamic configuration and the static must define in separated files:

- [https://docs.traefik.io/v2.1/getting-started/configuration-overview/#the-dynamic-configuration](https://docs.traefik.io/v2.1/getting-started/configuration-overview/#the-dynamic-configuration)
- [https://docs.traefik.io/v2.1/getting-started/configuration-overview/#the-static-configuration](https://docs.traefik.io/v2.1/getting-started/configuration-overview/#the-static-configuration)

Files:

> **docker-compose.yml**
>
> ```auto
> version: '3.3'
> services:
> traefik:
> image: traefik:v2.1.1
> container_name: my_traefik-monitor
> restart: unless-stopped
> security_opt:
> - no-new-privileges:true
> networks:
> - proxy
> environment:
> - TZ=Australia/Brisbane   
> ports:
> - 80:80
> - 443:443
> volumes:
> - /etc/localtime:/etc/localtime:ro
> - /var/run/docker.sock:/var/run/docker.sock:ro
> - /mnt/nas/docker/compose/traefik/traefik.toml:/traefik.toml:ro
> - /mnt/nas/docker/compose/traefik/config/:/config
> - /mnt/nas/logs/traefik:/logs
> - /mnt/nas/letsencrypt/acme.json:/letsencrypt/acme.json:rw
> labels:
> traefik.enable: true
> traefik.http.routers.http-catchall.rule: hostregexp(`{host:.+}`)
> traefik.http.routers.http-catchall.entrypoints: http
> traefik.http.routers.http-catchall.middlewares: redirect-to-https@file
> traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
> networks:
> proxy:
> external: true
> 
> ```

> **traefik.toml**
>
> ```auto
> [global]
> checkNewVersion = true
> 
> [entryPoints]
> [entryPoints.http]
> address = ":80"
>     
> [entryPoints.https]
> address = ":443"
> 
> [api]
> dashboard = true
> insecure = false
> 
> [log]
> level = "INFO"
> filePath = "/logs/traefik.log"
> format = "json"
> 
> [accessLog]
> filePath="/logs/traefikaccess.log"
> format="json"
> [accessLog.filters]
> statusCodes = ["200", "300-302"]
> retryAttempts = true
> minDuration = "10ms"
> [accessLog.fields]
> defaultMode = "keep"
> [accessLog.fields.names]
> "ClientUsername" = "drop"
> [accessLog.fields.headers]
> defaultMode = "keep"
> [accessLog.fields.headers.names]
> "User-Agent" = "redact"
> "Authorization" = "drop"
> "Content-Type" = "keep"
> 
> [providers.docker]
> endpoint = "unix:///var/run/docker.sock"
> exposedByDefault = false
> network = "proxy"
> 
> [providers.file]
> directory = "/config"
> wathc = true
> 
> [certificatesResolvers.letsencrypt.acme]
> email = "mydomain@protonmail.com"
> storage = "/letsencrypt/acme.json"
> [certificatesResolvers.letsencrypt.acme.tlsChallenge]
> 
> ```

> **/config/dyn.toml**
>
> ```auto
> [http.routers]
> 
> [http.routers.api]
> rule = "Host(`monitor.mydomain.com`)"
> entrypoints = ["https"]
> service = "api@internal"
> middlewares = ["traefik-basic-auth"]
> [http.routers.api.tls]
> certResolver = "letsencrypt"
> [[http.routers.api.tls.domains]]
> main = "monitor.mydomain.com"                                                                                                            
> sans = ["taps.mydomain.com","pipes.mydomain.com", "monitor.mydomain.com", "portainer.mydomain.com", "storm.mydomain.com","cloud.mydomain.com","pump.mydomain.com"]
> 
> [http.middlewares]
> 
> [http.middlewares.traefik-basic-auth]
> users = ["traefikadmin:$$2y$$05$$AAHlxk8PZExh/FilidNtF.YLpLYrJYZutxhDs8s30lCIClhOJINYi"]
> 
> [http.middlewares.redirect-to-https.redirectScheme]
> scheme = "https" 
> permanent = "true"
> 
> ```

* * *

Take a look to "Backticks or Quotes?" [https://docs.traefik.io/v2.1/routing/routers/#rule](https://docs.traefik.io/v2.1/routing/routers/#rule)

Recommend reads:

- [https://docs.traefik.io/v2.1/providers/file/](https://docs.traefik.io/v2.1/providers/file/)
- [https://docs.traefik.io/v2.1/observability/logs/](https://docs.traefik.io/v2.1/observability/logs/)
- [https://docs.traefik.io/v2.1/operations/dashboard/#secure-mode](https://docs.traefik.io/v2.1/operations/dashboard/#secure-mode)
- [https://docs.traefik.io/v2.1/https/acme/#tlschallenge](https://docs.traefik.io/v2.1/https/acme/#tlschallenge)
- [https://docs.traefik.io/v2.1/reference/static-configuration/cli/](https://docs.traefik.io/v2.1/reference/static-configuration/cli/)
- [https://docs.traefik.io/v2.1/reference/static-configuration/file/](https://docs.traefik.io/v2.1/reference/static-configuration/file/)
- [https://docs.traefik.io/v2.1/routing/providers/docker/](https://docs.traefik.io/v2.1/routing/providers/docker/)
- [https://blog.containo.us/traefik-2-0-docker-101-fc2893944b9d](https://blog.containo.us/traefik-2-0-docker-101-fc2893944b9d)
- [https://github.com/containous/blog-posts/tree/master/2019\_09\_10-101\_docker](https://github.com/containous/blog-posts/tree/master/2019_09_10-101_docker)

---

<div class="post-metadata">

**Author:** ![UnspecifiedId](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/unspecifiedid/32/8649_2.png) [@UnspecifiedId](https://community.traefik.io/u/UnspecifiedId)\
**Post date:** [January 19, 2020, 4:46am UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969/3 "2020-01-19T04:46:22Z")

</div>

Thanks for the effort in time in responding and providing the reading list. It's much appreciated.

After trying your suggestion, there are no log files generated nor are any of the containers appearing on the dashboard.

Within the traefik.toml file I switched DEBUG back on

```auto
[log]
  level = "DEBUG"
  filePath = "/logs/traefik.log"
  format = "json"

```

and fixed up a typo and explicitly named the dynamic configurations file.

```auto
[providers.file]
  directory = "/config"
  filename = "dyn.toml"
  watch = true

```

In the docker-compose YAML file no changes were made

I would have expected to see some type of output from

> docker logs container\_name

Though see nothing.

 ![TraefikNoService](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/6/6bbdf9331726de9ff34eac39bf5432dd4c5077ed.png)

Happy to take any suggestions.

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [January 19, 2020, 10:48am UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969/4 "2020-01-19T10:48:03Z")

</div>

> [@Unspecified](#):
>
> ```auto
> [providers.file]
> directory = "/config"
> filename = "dyn.toml"
> watch = true
> 
> ```

You cannot use `filename` and `directory` at the same time. I recommend to use `directory`.

* * *

In your first post, there were some errors and typos, I did not list them all, so I advise you to take my files.

The following example works for me (cert + logs + ...):

> **docker-compose.yml**
>
> ```auto
> version: '3.3'
> 
> services:
> 
> traefik:
> image: traefik:v2.1.2
> container_name: my_traefik-monitor
> restart: unless-stopped
> security_opt:
> - no-new-privileges:true
> networks:
> - proxy
> environment:
> - TZ=Australia/Brisbane   
> ports:
> - 80:80
> - 443:443
> volumes:
> - /etc/localtime:/etc/localtime:ro
> - /var/run/docker.sock:/var/run/docker.sock:ro
> - /mnt/nas/docker/compose/traefik/traefik.toml:/traefik.toml:ro
> - /mnt/nas/docker/compose/traefik/config/:/config
> - /mnt/nas/logs/traefik/:/logs
> - /mnt/nas/letsencrypt/:/letsencrypt/
> labels:
> traefik.enable: true
>       
> traefik.http.routers.http-catchall.rule: hostregexp(`{host:.+}`)
> traefik.http.routers.http-catchall.entrypoints: http
> traefik.http.routers.http-catchall.middlewares: redirect-to-https
> 
> traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
> traefik.http.middlewares.redirect-to-https.redirectscheme.permanent: true
> 
> networks:
> proxy:
> external: true
> 
> ```

> **/mnt/nas/docker/compose/traefik/traefik.toml**
>
> ```auto
> [global]
> checkNewVersion = true
> 
> [entryPoints]
> [entryPoints.http]
> address = ":80"
>     
> [entryPoints.https]
> address = ":443"
> 
> [api]
> dashboard = true
> insecure = false
> 
> [log]
> level = "DEBUG"
> filePath = "/logs/traefik.log"
> format = "json"
> 
> [accessLog]
> filePath="/logs/traefikaccess.log"
> format="json"
> [accessLog.filters]
> statusCodes = ["200", "300-302"]
> retryAttempts = true
> minDuration = "10ms"
> [accessLog.fields]
> defaultMode = "keep"
> [accessLog.fields.names]
> "ClientUsername" = "drop"
> [accessLog.fields.headers]
> defaultMode = "keep"
> [accessLog.fields.headers.names]
> "User-Agent" = "redact"
> "Authorization" = "drop"
> "Content-Type" = "keep"
> 
> [providers.docker]
> exposedByDefault = false
> network = "proxy"
> 
> [providers.file]
> directory = "/config"
> watch = true
> 
> [certificatesResolvers.letsencrypt.acme]
> email = "mydomain@protonmail.com"
> storage = "/letsencrypt/acme.json"
> [certificatesResolvers.letsencrypt.acme.tlsChallenge]
> 
> ```

> **/mnt/nas/docker/compose/traefik/config/dyn.toml**
>
> ```auto
> [http.routers]
> 
> [http.routers.api]
> rule = "Host(`monitor.mydomain.com`)"
> entryPoints = ["https"]
> service = "api@internal"
> middlewares = ["traefik-basic-auth"]
> [http.routers.api.tls]
> certResolver = "letsencrypt"
> [[http.routers.api.tls.domains]]
> main = "monitor.mydomain.com"                                                                                                            
> sans = ["taps.mydomain.com","pipes.mydomain.com", "monitor.mydomain.com", "portainer.mydomain.com", "storm.mydomain.com","cloud.mydomain.com","pump.mydomain.com"]
> 
> [http.middlewares]
> 
> [http.middlewares.traefik-basic-auth]
> users = ["traefikadmin:$$2y$$05$$AAHlxk8PZExh/FilidNtF.YLpLYrJYZutxhDs8s30lCIClhOJINYi"]
> 
> ```

Could you verify that the following paths are directories (not files):

- `/mnt/nas/docker/compose/traefik/`
- `/mnt/nas/docker/compose/traefik/config/`
- `/mnt/nas/logs/traefik/`
- `/mnt/nas/letsencrypt/`

---

<div class="post-metadata">

**Author:** ![UnspecifiedId](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/unspecifiedid/32/8649_2.png) [@UnspecifiedId](https://community.traefik.io/u/UnspecifiedId)\
**Post date:** [January 19, 2020, 1:33pm UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969/5 "2020-01-19T13:33:45Z")

</div>

Thanks for the continued support.

In relation to your question, the paths are directories.

I tried your files verbatim and unfortunately could not get the desired result.

If I use labels as below, traefik loads, and correctly grabs LetsEncrypt certificates. The conflict seems to be in the TOML file (again I defer to you around the syntax and correctness of the labels). My entire journey started when I was trying to obtain debug output into a log file to troubleshoot a container issue. To date, I'm yet to see output to a traefik log file from label, YAML or TOML

Is there any issue if there are multiple yml, toml files in the folder where docker-compose is instantiated from ?

```auto
version: '3'

services:
  traefik:
    image: traefik:v2.1.1
    container_name: my_traefik-monitor
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    environment:
      - TZ=Australia/Brisbane
    ports:
      - 80:80
      - 443:443
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /mnt/nas/config/traefik/traefik.yml:/traefik.yml:ro
      #- /mnt/nas/config/traefik/traefik.toml:/traefik.toml
      - /mnt/nas/config/traefik/acme.json:/acme.json
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`monitor.mydomain.com`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=traefikadmin:$$2y$$05$$AAHlxk8PZExh/FilidNtF.YLpLYrJYZutxhDs8s30lCIClhOJINYi"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - traefik.http.routers.traefik.service=api@internal
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`monitor.mydomain.com`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=http"
      - "traefik.http.routers.traefik-secure.service=api@internal"
     # - "traefik.http.services.loadbalancer.server.port=443"

networks:
  proxy:
    external: true

```

traefik.yml configuration file

```auto
api:
  dashboard: true

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false

certificatesResolvers:
  http:
    acme:
      email: myemail@protonmail.com
      storage: acme.json
      httpChallenge:
        entryPoint: http

```

Working dashboard from labels

 ![TraefikWorking](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/b3418b8c8f8625ee09ae7e9d928490b61b40b994.png)

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [January 19, 2020, 2:12pm UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969/6 "2020-01-19T14:12:38Z")

</div>

The [static configuration](https://docs.traefik.io/v2.1/getting-started/configuration-overview/#the-static-configuration) (`traefik.yml` or `traefik.toml`) can only be define in one file

The dynamic configuration (routers, middlewares, services) must be define in a separate file and I recommend to use a separate folder (like in my example)

> [@ldez](#):
>
> in the v2, the dynamic configuration and the static must define in separated files:
> 
> - [https://docs.traefik.io/v2.1/getting-started/configuration-overview/#the-dynamic-configuration](https://docs.traefik.io/v2.1/getting-started/configuration-overview/#the-dynamic-configuration)
> - [Configuration Introduction | Traefik | v2.1](https://docs.traefik.io/v2.1/getting-started/configuration-overview/#the-static-configuration)

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [January 19, 2020, 2:23pm UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969/7 "2020-01-19T14:23:09Z")

</div>

My previous example works as expected but I can provide to you some versions without any files:

> **Example 1**
>
> ```auto
> version: '3'
> 
> services:
> traefik:
> image: traefik:v2.1.1
> container_name: my_traefik-monitor
> restart: unless-stopped
> security_opt:
> - no-new-privileges:true
> networks:
> - proxy
> environment:
> - TZ=Australia/Brisbane
> ports:
> - 80:80
> - 443:443
> volumes:
> - /etc/localtime:/etc/localtime:ro
> - /var/run/docker.sock:/var/run/docker.sock:ro
> - /mnt/nas/config/traefik/acme.json:/acme.json
> command:
> - --api
> - --entryPoints.http.address=:80
> - --entryPoints.https.address=:443
> - --providers.docker.exposedByDefault=false
> - --providers.docker.network=proxy
> - --certificatesResolvers.http.acme.email=myemail@protonmail.com
> - --certificatesResolvers.http.acme.storage=/acme.json
> - --certificatesResolvers.http.acme.httpChallenge.entryPoint=http
> labels:
> traefik.enable: true
>      
> # HTTP to HTTPS redirection
> traefik.http.routers.http_catchall.rule: hostregexp(`{host:.+}`)
> traefik.http.routers.http_catchall.entrypoints: web
> traefik.http.routers.http_catchall.middlewares: https_redirect
> 
> # Dashboard
> traefik.http.routers.traefik-secure.rule: Host(`monitor.mydomain.com`)
> traefik.http.routers.traefik-secure.entrypoints: https
> traefik.http.routers.traefik-secure.middlewares: traefik-auth
> traefik.http.routers.traefik-secure.tls: true
> traefik.http.routers.traefik-secure.tls.certresolver: http
> traefik.http.routers.traefik-secure.service: api@internal
> 
> # Middlewares
> traefik.http.middlewares.traefik-auth.basicauth.users: traefikadmin:$$2y$$05$$AAHlxk8PZExh/FilidNtF.YLpLYrJYZutxhDs8s30lCIClhOJINYi
> traefik.http.middlewares.https_redirect.redirectscheme.scheme: https
> 
> networks:
> proxy:
> external: true
> 
> ```

> **Example 2**
>
> ```auto
> version: '3'
> 
> services:
> traefik:
> image: traefik:v2.1.1
> container_name: my_traefik-monitor
> restart: unless-stopped
> security_opt:
> - no-new-privileges:true
> networks:
> - proxy
> environment:
> - TZ=Australia/Brisbane
> ports:
> - 80:80
> - 443:443
> volumes:
> - /etc/localtime:/etc/localtime:ro
> - /var/run/docker.sock:/var/run/docker.sock:ro
> - /mnt/nas/config/traefik/acme.json:/acme.json
> - /mnt/nas/logs/traefik/:/logs/
> command:
> - --global.checkNewVersion
> - --entryPoints.http.address=:80
> - --entryPoints.https.address=:443
> - --api
> - --providers.docker.exposedByDefault=false
> - --providers.docker.network=proxy
> - --log.level=INFO
> - --log.filePath=/logs/traefik.log
> - --log.format=json
> - --accessLog.filePath=/logs/traefikaccess.log
> - --accessLog.format=json
> - --accessLog.filters.statusCodes=200,300-302
> - --accessLog.filters.retryAttempts=true
> - --accessLog.filters.minDuration=10ms
> - --accessLog.fields.defaultMode=keep
> - --accessLog.fields.names.ClientUsername=drop
> - --accessLog.headers.defaultMode=keep
> - --accessLog.headers.names.User-Agent=redact
> - --accessLog.headers.names.Authorization=drop
> - --accessLog.headers.names.Content-Type=keep
> - --certificatesResolvers.letsencrypt.acme.email=mydomain@protonmail.com
> - --certificatesResolvers.letsencrypt.acme.storage=/acme.json
> - --certificatesResolvers.letsencrypt.acme.tlsChallenge=true
> labels:
> traefik.enable: true
>       
> # HTTP to HTTPS redirection
> traefik.http.routers.http-catchall.rule: hostregexp(`{host:.+}`)
> traefik.http.routers.http-catchall.entrypoints: web
> traefik.http.routers.http-catchall.middlewares: https_redirect
> 
> # Dashboard
> traefik.http.routers.traefik-secure.rule: Host(`monitor.mydomain.com`)
> traefik.http.routers.traefik-secure.entrypoints: https
> traefik.http.routers.traefik-secure.middlewares: traefik-auth
> traefik.http.routers.traefik-secure.tls: true
> traefik.http.routers.traefik-secure.tls.certresolver: http
> traefik.http.routers.traefik-secure.service: api@internal
> 
> # Middlewares
> traefik.http.middlewares.traefik-auth.basicauth.users: traefikadmin:$$2y$$05$$AAHlxk8PZExh/FilidNtF.YLpLYrJYZutxhDs8s30lCIClhOJINYi
> traefik.http.middlewares.https_redirect.redirectscheme.scheme: https
> 
> networks:
> proxy:
> external: true
> 
> ```

Recommend read:

- [https://blog.containo.us/traefik-2-0-docker-101-fc2893944b9d](https://blog.containo.us/traefik-2-0-docker-101-fc2893944b9d)
- [https://github.com/containous/blog-posts/tree/master/2019\_09\_10-101\_docker](https://github.com/containous/blog-posts/tree/master/2019_09_10-101_docker)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [February 17, 2021, 12:50pm UTC](https://community.traefik.io/t/traefik-configuration-letsencrypt-router-general-issues-toml-vs-yaml-vs-cli/3969/9 "2021-02-17T12:50:33Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.