My cert expired so it work once, maybe I change something since it worked but I can't find what.
The cert is not being updated by traefik anymore and I can't see anything in the logs related to this.
my traefik.yml file
# https://docs.ibracorp.io/traefik/master/docker-compose/config-files-explained
global:
checkNewVersion: true
sendAnonymousUsage: false
serversTransport:
insecureSkipVerify: true # allow insecure backend connections
entryPoints: # Not used in apps, but redirect everything from HTTP to HTTPS
http80:
address: :80
http:
redirections:
entryPoint:
to: https443
scheme: https
permanent: true
# HTTPS endpoint, with domain wildcard
https443:
address: :443
#forwardedHeaders:
# trustedIPs: *trustedIps # Reuse list of Cloudflare Trusted IP's above for HTTPS requests
http:
tls:
certResolver: letsencrypt
domains:
- main: asd.com.es
sans:
- '*.asd.com.es'
middlewares:
- securityHeaders@file
providers:
providersThrottleDuration: 15s
file:
filename: /etc/traefik/fileConfig.yml
watch: true
# Docker provider for connecting all apps that are inside of the docker network
docker:
watch: true
network: br2 # Add Your Docker Network Name Here
# Default host rule to containername.domain.example
defaultRule: "Host(`{{ index .Labels \"com.docker.compose.service\"}}.asd.com.es`)"
swarmModeRefreshSeconds: 15s
exposedByDefault: false
endpoint: "tcp://wpsocketproxy:2375"
# Enable traefik ui
api:
dashboard: true
insecure: false
# Log level INFO|DEBUG|ERROR
log:
level: DEBUG # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
filePath: "/etc/traefik/logs/traefik.log"
accesslog:
filePath: "/etc/traefik/logs/access.log"
bufferingSize: 100
filters:
statusCodes:
- "200-299"
- "400-499"
- "500-599"
# Use letsencrypt to generate ssl serficiates
certificatesResolvers:
letsencrypt:
acme:
email: server@server.com
storage: /etc/traefik/acme.json
dnsChallenge:
provider: cloudflare
# Used to make sure the dns challenge is propagated to the rights dns servers
resolvers:
- "1.1.1.1:53"
- "1.0.0.1:53"
delayBeforeCheck: 90
# Traefik plugins
experimental:
plugins:
crowdsec-bouncer-traefik-plugin:
moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
version: "v1.1.13-beta-fix-104"
traefik-modsecurity-plugin:
moduleName: "github.com/acouvreur/traefik-modsecurity-plugin"
version: "v1.3.0"
my fileconfig.yml
http:
# Home Assistant
routers:
homeassistant:
entryPoints:
- https443
rule: 'Host(`ha.asd.com.es`)'
service: homeassistant
middlewares:
- traefik-csbouncer
- traefik-modsecurity
- rate-limit
plex:
entryPoints:
- https443
rule: 'Host(`plex.asd.com.es`)'
service: plex
middlewares:
#- traefik-csbouncer
#- traefik-modsecurity
services:
homeassistant:
loadBalancer:
servers:
- url: http://10.10.10.100:8123/
plex:
loadBalancer:
servers:
- url: http://10.10.50.20:32400/
## MIDDLEWARES ##
middlewares:
# Only Allow Local networks
local-ipwhitelist:
ipWhiteList:
sourceRange:
- 10.10.10.1/24 # localhost
# Rate limit
rate-limit:
rateLimit:
average: 200
burst: 100
# Crowdsec bouncer
traefik-csbouncer:
plugin:
crowdsec-bouncer-traefik-plugin:
enabled: true
logLevel: INFO
updateIntervalSeconds: 30 # stream mode only
#defaultDecisionSeconds: 60 # live mode only
crowdsecMode: stream
crowdsecLapiKey: b2e210d71f34de53c8fe68d4f970e060 # Api key for 'traefik'
crowdsecLapiHost: 10.10.50.11:8080
crowdsecLapiScheme: http
crowdsecLapiTLSInsecureVerify: false
#forwardedHeadersTrustedIPs: # List of IPs of trusted Proxies that are in front of traefik (ex: Cloudflare)
clientTrustedIPs:
- 10.10.10.1/24
forwardedHeadersCustomName: X-Forwarded-For
redisCacheEnabled: true
redisCacheHost: redis-cs:6379
redisCachePassword: 3QVMvJWExUVKDGtbU8ucJKacBCBLH3rP
redisCacheDatabase: 1
traefik-modsecurity:
plugin:
traefik-modsecurity-plugin:
#MaxBodySize: "52428800"
ModsecurityUrl: http://modsecurity:80
TimeoutMillis: "2000"
# Enable gzip compression
test-compress:
compress: {}
# Security headers
securityHeaders:
headers:
customResponseHeaders:
X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex"
server: ""
X-Forwarded-Proto: "https"
sslProxyHeaders:
X-Forwarded-Proto: "https"
referrerPolicy: "strict-origin-when-cross-origin"
hostsProxyHeaders:
- "X-Forwarded-Host"
customRequestHeaders:
X-Forwarded-Proto: "https"
framedeny: true # Set frameDeny to true to add the X-Frame-Options header with the value of DENY.
contentTypeNosniff: true # Set contentTypeNosniff to true to add the X-Content-Type-Options header with the value nosniff.
browserXssFilter: true
forceSTSHeader: true
stsIncludeSubdomains: true
stsSeconds: 63072000
stsPreload: true
permissionsPolicy: "geolocation=(self), interest-cohort=(), camera=(), microphone=(), payment=(), usb=(), vr=(), web-share=()"
#contentSecurityPolicy: "report-uri csp:8080, default-src 'self'"
# default-src 'self';
# script-src 'report-sample' 'self';
# style-src 'report-sample' 'self';
# object-src 'none';
# base-uri 'self';
# connect-src 'self';
# font-src 'self';
# frame-src 'self';
# img-src 'self';
# manifest-src 'self';
# media-src 'self';
# report-uri https://64771d916de1519cde13ca45.endpoint.csper.io/?v=0;
# worker-src 'none';
# accessControlAllowMethods:
# - GET
# - OPTIONS
# - PUT
# accessControlMaxAge: 100
# Only use secure ciphers - https://ssl-config.mozilla.org/#server=traefik&version=2.6.0&config=intermediate&guideline=5.6
tls:
options:
default:
minVersion: VersionTLS12
cipherSuites:
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 # TLS 1.2
- TLS_AES_256_GCM_SHA384 # TLS 1.3
- TLS_CHACHA20_POLY1305_SHA256 # TLS 1.3
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
#curvePreferences:
# - CurveP521
# - CurveP384
sniStrict: true
