Traefik container behind BIGIP reverse proxy returns 404 due to https/http conflict

Traefik Traefik v3 (latest)
1

Hi everyone,

We are running Traefik container as part of a CVAT app from GitHub. I'm running an out of the box setup, running docker-compose.yml with the default configuration. I set the environment variable to my domain. Our organization uses BIGIP, amongst other things, to serve a reverse proxy behind which is our CVAT deployment. Unfortunately we are getting a 404 response from Traefik.
The log shows:

{"ClientHost":"172.18.0.163","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":37901,"RequestHost":"cvat.mydomain.com","RequestMethod":"GET","RequestPath":"/","RequestPort":"-","RequestProtocol":"HTTP/1.1","StartUTC":"2025-05-05T18:47:03.645783843Z","level":"info","msg":"","time":"2025-05-05T18:47:03Z"}

The tcpdump show, that there seems to be a connection negotiation

12:50:06.328476 IP (tos 0x0, ttl 63, id 19719, offset 0, flags [DF], proto TCP (6), length 1332)
    172.18.5.42.8080 > 172.18.0.164.13912: Flags [P.], cksum 0x6319 (incorrect -> 0x1c78), seq 1:1293, ack 204, win 501, length 1292: HTTP
        0x0000:  001b 1700 0110 0015 5d1e 2801 0800 4500  ........].(...E.
        0x0010:  0534 4d07 4000 3f06 8bca ac12 052a ac12  .4M.@.?......*..
        0x0020:  00a4 1f90 3658 e67f 0940 549d 77ac 5018  ....6X...@T.w.P.
        0x0030:  01f5 6319 0000 1603 0300 3b02 0000 3703  ..c.......;...7.
        0x0040:  0350 9d04 4411 64f8 eb4f e890 e5af d628  .P..D.d..O.....(
        0x0050:  a2ca f905 028e 4afc 6e44 4f57 4e47 5244  ......J.nDOWNGRD
        0x0060:  0100 c02f 0000 0fff 0100 0100 0017 0000  .../............
        0x0070:  000b 0002 0100 1603 0303 6c0b 0003 6800  ..........l...h.
        0x0080:  0365 0003 6230 8203 5e30 8202 46a0 0302  .e..b0..^0..F...
        0x0090:  0102 0211 009d 25b4 9bdb 143c 0d5b 660d  ......%....<.[f.
        0x00a0:  865b 9176 4930 0d06 092a 8648 86f7 0d01  .[.vI0...*.H....
        0x00b0:  010b 0500 301f 311d 301b 0603 5504 0313  ....0.1.0...U...
        0x00c0:  1454 5241 4546 494b 2044 4546 4155 4c54  .TRAEFIK.DEFAULT
        0x00d0:  2043 4552 5430 1e17 0d32 3530 3530 3631  .CERT0...2505061
        0x00e0:  3234 3930 355a 170d 3236 3035 3036 3132  24905Z..26050612
        0x00f0:  3439 3035 5a30 1f31 1d30 1b06 0355 0403  4905Z0.1.0...U..
        0x0100:  1314 5452 4145 4649 4b20 4445 4641 554c  ..TRAEFIK.DEFAUL
        0x0110:  5420 4345 5254 3082 0122 300d 0609 2a86  T.CERT0.."0...*.
        0x0120:  4886 f70d 0101 0105 0003 8201 0f00 3082  H.............0.
        0x0130:  010a 0282 0101 00b0 1e29 0714 d670 a06f  .........)...p.o

In the local network of the machine where the docker run I added "cvat.mydomain.com" to /etc/hosts a I discovered:

  1. The app runs under http://cvat.mydomain.com:8080
  2. On https://cvat.mydomain.com:8080 the browser raises an invalid cert warning and then hits with the 404 status code

We've tried playing around with Traefik configuration to perhaps disable the https being served on the same port, but without luck.

My question is, how do we come around solving this issue?

best regards,
Szymon

2

There is no router name in the JSON access log, so it seems none of your Traefik router rules matched the request.

3

Correct, that's what I noticed when comparing with the spoofed connection:

{"ClientHost":"10.0.2.52","DownstreamContentSize":653,"DownstreamStatus":200,"Duration":23815014,"RequestHost":"cvat.mydomain.com","RequestMethod":"GET","RequestPath":"/","RequestPort":"8080","RequestProtocol":"HTTP/1.1","RouterName":"cvat-ui@docker","StartUTC":"2025-05-06T08:17:26.631000839Z","level":"info","msg":"","time":"2025-05-06T08:17:26Z"}

But doesn't this come from Traefik?

4

Also, when I set the CVAT_HOST to the machines IP address, all works fine - from within the network.