Traefik macvlan and synology configuration problem

Traefik Traefik v3 (latest)
1

Hello everyone !

I would like to set up Traefik on my nas.
I made a docker compose like this:

services:
  reverse-proxy:
    image: traefik:v3
    container_name: traefik_v3
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.yml:/traefik.yml
      - ./config:/config:ro
      - ./acme.json:/acme.json
      - ./certs:/certs:ro
    networks:
      traefik_bridge:
      macvlan:
        ipv4_address: 

networks:
  traefik_bridge:
    external : true
  macvlan:
    name: macvlan
    driver: macvlan
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: "192.168.1.0/24"
          ip_range: "192.168.1.240/29"
          gateway: "192.168.1.1"192.168.1.241

I use the file provider for my config:

providers:
  file:
    directory: /config
    watch: true

Here is the config to access Traefik :

http:
  routers:
    traefik-http:
      entryPoints:
        - web
      rule: "Host(`traefik.syno`)"
      service: traefik

    traefik-https:
      entryPoints:
        - websecure
      rule: "Host(`traefik.syno`)"
      tls: {}
      service: traefik

  services:
    traefik:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:8080"

so if I try to access traefik.sino via http I have no problem!

On the other hand, when I try to access via https, it's a tragedy :smiley: :

502 Bad Gateway
Certificate verify failed: self signed certificate

Can you help me resolve my problem?

Here are the TLS logs :

2024-10-08T09:53:30Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 > Serving default certificate for request: "traefik.syno" 2024-10-08T09:53:30Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 > Serving default certificate for request: "traefik.syno" 2024-10-08T09:53:30Z DBG log/log.go:245 > http: TLS handshake error from 192.168.1.25:65425: EOF 2024-10-08T09:53:30Z DBG log/log.go:245 > http: TLS handshake error from 192.168.1.25:65452: EOF

2

When you enable plain TLS (tls: {}), it will use existing TLS cert files loaded via dynamic tls config. If none or no HostSNI matching one is found, Traefik will use a custom created TLS cert, that is not trusted by clients/browsers.

If you have existing TLS certs, load them properly.

If you want to use LetsEncrypt to create certs, setup certResolver. Compare to simple Traefik example.

Note that LetsEncrypt needs a real Internet domain. With dnsChallenge, the target IP does not need to be available on the Internet.

1 Like
3

Thx Bluepuma for your information.
I will try this tomorrow and I keep you informed :pray: