Unable to get HTTPS to work at all

Traefik Traefik v3 (beta)
,
1

So I have tried Traefik 2.11 and 3.0rc-1 and I am just unable to get cert issuance working... Havent even worried about redirection yet ...

My config is as follows:

traefik:
    hostname: traefik.xxxxx.xxxxx
    image: traefik:v3.0
    restart: always
    privileged: true
    command:
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --accesslog.filepath=/var/log/access.log

      - --api=true
      - --log.level=DEBUG
      - --accesslog=true
      - --api.insecure=true
      - --accesslog.addinternals
      - --api.dashboard=true

      - --accesslog.filters.statuscodes=200,300-399,500-599
      - --accessLog.bufferingSize=100

      - --entrypoints.web.http.redirections.entryPoint.to=websecure # Redirect http to https
      - --entrypoints.web.http.redirections.entryPoint.scheme=https

      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=5
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53

      # ## Routers Rules
      # - traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME`)
      # - traefik.http.routers.traefik-rtr.tls=true
      # - traefik.http.routers.traefik-rtr.tls.certresolver=letsencrypt


      # !IMPORTANT - COMMENT OUT THE FOLLOWING LINE IN PRODUCTION!
      # - --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      - --providers.docker.network=public
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false

    env_file:
      - ./.env

    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik-secure.tls.domains[0].main=xxxxx.xxxx
      - traefik.http.routers.traefik-secure.tls.domains[0].sans=*.xxxx.xxxx
      - traefik.http.routers.traefik.rule=Host(`${HOST_NAME}`)
      - traefik.http.routers.traefik.entrypoints=websecure,web
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.tls=true
      - traefik.http.routers.traefik.tls.certresolver=letsencrypt

      # enable https for api/dashboard
      - traefik.http.routers.api.tls.certresolver=letsencrypt
      - traefik.http.routers.api.entrypoints=websecure
      - traefik.http.routers.api.rule=Host(`traefik.xxxxx.xxxxx`)
    networks:
      - public
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_data:/letsencrypt
      - /mnt/pve/proxmox_nfs/shared-configs/log:/var/log


  whoami:
    image: "traefik/whoami"
    container_name: "simple-service"
    hostname: whoami
    networks:
      - public
    ports:
      - 9992:80
    labels:
      - traefik.enable=true
      - traefik.http.routers.whoami.rule=Host(`whoami.xxxxx.xxxxx`)
      - traefik.http.routers.whoami.entrypoints=web, websecure
      - traefik.http.routers.whoami.tls.certresolver=letsencrypt

There is almost certainly some cargo culting here with various bits I've found in various sources over the internet so dont judge to much :slight_smile:

I assume I am doing something really stupid and would love a second set of eyes...

Startup logs in debug

I had to put the logs in a gist becaue it was to large for the post

Thanks for any help anyone can provide

2

What’s your issue? It seems a TLS cert is created, check acme.json content, make sure it’s persisted with bind mount or volume.

Check and compare to simple Traefik example.

Why use privileged: true, that’s not best practice.

3

So So annoyed by this..... Turns out k3s was running w/ Traefik running and turns out an iptables rule was sending 443 and 80 to k3s and not my standalone test run of Traefik in Docker... This is why nothing else showed up listening on 80 or 443 when I ran netstat / lsof, which was my logical course of action when I could not get any indications of a request hitting my test instance of Traefik but I was getting 404's back from something.... Drove me nuts all day until I figured it out :slight_smile:

TLDR..... User error