Traefik http to https redirection behind AWS ALB causes infinite loop and failing health checks

Traefik Traefik v2
,
1

First of all, thank you for the traefik. It is awesome.

Currently, I am replacing nginx with traefik as a reverse proxy. It works seamlessly but when I added the redirectScheme middleware It caused an infinite loop and also the ALB health checks also starts to fails. BTW I am using ECS for deployment.

I am no expert in Networking stuff. So please, anyone has any idea how to solve this problem please do let me know.

Flow:
Request ---> ALB ---> Traefik ---> API

Below are my configuration.
traefik.yaml


accessLog: {}

log:
  level: INFO
  format: json

providers:
  docker:
    endpoint: unix:///var/run/docker.sock
    exposedByDefault: false
  file:
    directory: /etc/traefik/providers

file.provider.yaml

http:
  middlewares:
    https-only:
      redirectScheme:
        scheme: https
        permanent: true

task-definition.json

{
    "containerDefinitions": [
        {
            "name": "backend",
            "hostname": "backend",
            "dockerLabels": {
                "traefik.enable": "true",
                "traefik.http.routers.backend.rule": "PathPrefix(`/`)",
                "traefik.http.routers.backend.middlewares": "for-dev@file"
            }
        },
        {
            "name": "proxy",
            "hostname": "proxy",
            "portMappings": [
                {
                    "hostPort": 80,
                    "containerPort": 80
                }
            ],
            "links": ["backend"],
            "mountPoints": [
                {
                    "sourceVolume": "docker-socket",
                    "containerPath": "/var/run/docker.sock"
                }
            ]
        }
    ],
    "volumes": [
        {
            "name": "docker-socket",
            "host": {
                "sourcePath": "/var/run/docker.sock"
            }
        }
    ]
}
2

Hey :slight_smile:

The issue is, that propbably your ALB already terminates TLS and therefore connects with Traefik always on HTTP. Therefore, Traefik will force a redirect to HTTPS but as the ALB upfront always uses HTTP, that's gonna be the issue.

Can you move the TLS termination to Traefik?

3

Thankyou so much for your suggestion.

I will try to move the TLS termination to traefik. Do I need to open the 443 port or It will work without that.

I am kinda new to this stuff. But traefik seems like fun. :grin:

1 Like
4

443 needs to be open :wink:

1 Like