# Traefik global redirect to https except one container

**URL:** <https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, docker\
**Created:** [March 2, 2020, 7:10pm UTC](https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722 "2020-03-02T19:10:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![peter3637](https://avatars.discourse-cdn.com/v4/letter/p/9de0a6/32.png) [@peter3637](https://community.traefik.io/u/peter3637)\
**Post date:** [March 2, 2020, 7:10pm UTC](https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722/1 "2020-03-02T19:10:30Z")

</div>

Hello,  
currently I use a global forwarding on https in Traefik. I would like to continue using this except for one container in Traefik.

This is how my setup looks like:

```auto
version: "3.6"

services:
  traefik:
    container_name: traefik
    image: "traefik:latest"
    command:
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --providers.docker
      - --api
      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge=true"
      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.myhttpchallenge.acme.email=email"
      - "--certificatesresolvers.myhttpchallenge.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
    labels:
      # Dashboard
      - "traefik.http.routers.traefik.rule=Host(`domain.com`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls.certresolver=myhttpchallenge"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.middlewares=authtraefik"
      - "traefik.http.middlewares.authtraefik.basicauth.users=user:pass"
      - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.entrypoints=web"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

    restart: always

  nginx:
    container_name: nginx
    build: ./nginx/
    labels:
      - "traefik.http.routers.nginx.rule=Host(`domain2.com`)"
      - "traefik.http.routers.nginx.entrypoints=websecure"
      - "traefik.http.routers.nginx.tls=true"
      - "traefik.http.routers.nginx.tls.certresolver=myhttpchallenge"
    restart: always

```

What do I have to do to reach the NGINX container via http and https?

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [March 2, 2020, 8:03pm UTC](https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722/2 "2020-03-02T20:03:50Z")

</div>

Add another router to the nginx server that uses the web entry point. You will have to add priority too as the redirect by default will take precedence(rule length).

[https://docs.traefik.io/routing/routers/#priority](https://docs.traefik.io/routing/routers/#priority)

---

<div class="post-metadata">

**Author:** ![peter3637](https://avatars.discourse-cdn.com/v4/letter/p/9de0a6/32.png) [@peter3637](https://community.traefik.io/u/peter3637)\
**Post date:** [March 3, 2020, 9:08am UTC](https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722/3 "2020-03-03T09:08:16Z")

</div>

Thanks for your answer. Unfortunately I still can't reach my website via http. It is still redirected to https.  
I have tried the following:

```auto
nginx:
    container_name: nginx
    build: ./nginx/
    labels:
      - "traefik.http.routers.nginx.rule=Host(`domain2.com`)"
      - "traefik.http.routers.nginx.entrypoints=websecure"
      - "traefik.http.routers.nginx.tls=true"
      - "traefik.http.routers.nginx.tls.certresolver=myhttpchallenge"
      - "traefik.http.routers.nginx.priority=1"
      - "traefik.http.routers.nginxhttp.entrypoints=web"
      - "traefik.http.routers.nginxhttp.priority=2"
    restart: always

```

Would it also be possible to bypass a redirection just by adding a parameter in the URL?  
Example: [domain2.com?https=false](http://domain2.com?https=false)

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [March 3, 2020, 12:29pm UTC](https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722/4 "2020-03-03T12:29:59Z")

</div>

The priority is too low.

> The priority is directly equal to the length of the rule, and so the longest length has the highest priority.

> [@peter3637](#):
>
> Would it also be possible to bypass a redirection just by adding a parameter in the URL?  
> Example: [domain2.com?https=false](http://domain2.com?https=false)

Yes, as long as the subequent Rule length is greater than the redirect rule.

---

<div class="post-metadata">

**Author:** ![peter3637](https://avatars.discourse-cdn.com/v4/letter/p/9de0a6/32.png) [@peter3637](https://community.traefik.io/u/peter3637)\
**Post date:** [March 3, 2020, 1:04pm UTC](https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722/5 "2020-03-03T13:04:32Z")

</div>

Could you please give me a source code example for both cases?

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [March 3, 2020, 2:47pm UTC](https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722/6 "2020-03-03T14:47:23Z")

</div>

The length of your https-catchall Rule `hostregexp(`{host:.+}`)` is 23 so anything with a priority greater than this will evaluate before.

Therefore: `traefik.http.routers.nginxhttp.priority=24`

You don't have a Rule on the nginxhttp Router. So it will use the [defaultRule](https://docs.traefik.io/providers/docker/#defaultrule) for the docker provider and not match [domain2.com](http://domain2.com)

```yaml
nginx:
    container_name: nginx
    build: ./nginx/
    labels:
      - "traefik.http.routers.nginx.rule=Host(`domain2.com`)"
      - "traefik.http.routers.nginx.entrypoints=websecure"
      - "traefik.http.routers.nginx.tls=true"
      - "traefik.http.routers.nginx.tls.certresolver=myhttpchallenge"
      # Not required does not share entrypoint with http-catchall
      # - "traefik.http.routers.nginx.priority=1"
      # need the Host rule too
      - "traefik.http.routers.nginx.rule=Host(`domain2.com`)"
      - "traefik.http.routers.nginxhttp.entrypoints=web"
     # Update to have priority greater than http-catchall rule. Increase it you really want.
      - "traefik.http.routers.nginxhttp.priority=24"
    restart: always

```

> [@peter3637](#):
>
> Would it also be possible to bypass a redirection just by adding a parameter in the URL?  
> Example: [domain2.com?https=false](http://domain2.com?https=false)

Sorry I meant "yes you can route on a query string" not "you can bypass the redirect"

---

<div class="post-metadata">

**Author:** ![peter3637](https://avatars.discourse-cdn.com/v4/letter/p/9de0a6/32.png) [@peter3637](https://community.traefik.io/u/peter3637)\
**Post date:** [March 3, 2020, 4:17pm UTC](https://community.traefik.io/t/traefik-global-redirect-to-https-except-one-container/4722/7 "2020-03-03T16:17:03Z")

</div>

Thanks a lot. This is exactly what I needed 🙂