Hello,
I’m new to Traefik and might have made a few mistakes in my configuration.
My objective was to use Traefik as a reverse proxy for the other Docker containers running on my host. I’m managing containers with Portainer.
To start, let’s share my configuration files.
traefik-stack (docker compose file) :
services:
traefik-reverse-proxy:
image: traefik:latest
restart: unless-stopped
environment:
- TZ=Europe/Berlin
ports:
# The HTTP port
- "80:80"
# The HTTPS port
- "443:443"
# The Traefik port
- "8080:8080"
volumes:
- traefik-main-config:/etc/traefik/
- traefik-config-files:/etc/traefik/conf/
- traefik-ca:/etc/traefik/certs/
# So that Traefik can listen to the Docker events
- /var/run/docker.sock:/var/run/docker.sock:ro
volumes:
traefik-main-config:
traefik-config-files:
traefik-ca:
traefik.yaml (located in traefik-main-conf volume) :
global:
checkNewVersion: false
sendAnonymousUsage: false
# -- (Optional) Change Log Level and Format here...
# - loglevels [DEBUG, INFO, WARNING, ERROR, CRITICAL]
# - format [common, json, logfmt]
# log:
# level: ERROR
# format: common
# filePath: /var/log/traefik/traefik.log
# -- (Optional) Enable Accesslog and change Format here...
# - format [common, json, logfmt]
# accesslog:
# format: common
# filePath: /var/log/traefik/access.log
# -- (Optional) Enable API and Dashboard here, don't do in production
api:
dashboard: true
insecure: true
# -- Change EntryPoints here...
entryPoints:
web:
address: :80
# -- (Optional) Redirect all HTTP to HTTPS
# http:
# redirections:
# entryPoint:
# to: websecure
# scheme: https
websecure:
address: :443
# -- (Optional) Add custom Entrypoint
traefik:
address: :8080
# -- Change CertificateResolver here...
#certificatesResolvers:
# myresolver:
# caServer: /etc/traefik/certs/MY-ROOT-CA.crt
# -- (Optional) Disable TLS Cert verification check
# serversTransport:
# insecureSkipVerify: true
providers:
docker:
# -- (Optional) Enable this, if you want to expose all containers automatically
exposedByDefault: false
file:
directory: /etc/traefik
watch: true
dynamic_conf.yaml (located in traefik-main-conf volume) :
# -- (Optional) Overwrite Default Certificates
tls:
#certificatesResolvers:
# myresolver:
# caServer: /etc/traefik/certs/MY-ROOT-CA.crt
certificates:
# Note that since no store is defined,
# the certificate below will be stored in the `default` store.
# Certificatecain
- certFile: /etc/traefik/certs/MY-ROOT-CA.crt
stores:
- mystore
- certFile: /etc/traefik/certs/MY-Policy-CA.crt
stores:
- mystore
- certFile: /etc/traefik/certs/MY-Issuing-CA.crt
stores:
- mystore
# Webserver Certificates
- certFile: /etc/traefik/certs/treafik.my-domain.com.crt
keyFile: /etc/traefik/certs/traefik.my-domain.com.key
stores:
- mystore
- certFile: /etc/traefik/certs/netbox.my-domain.com.crt
keyFile: /etc/traefik/certs/netbox.my-domain.com.key
stores:
- mystore
- certFile: /etc/traefik/certs/phpipam.my-domain.com.crt
keyFile: /etc/traefik/certs/phpipam.my-domain.com.key
stores:
- mystore
# -- (Optional) Disable TLS version 1.0 and 1.1
# options:
# default:
# minVersion: VersionTLS12
netbox-stack (docker compose file) :
<..>
services:
netbox:
<<: *shared_settings
logging:
driver: journald
labels:
- traefik.enable=true
- traefik.http.routers.netbox-proxy.rule=Host(`netbox.my-domain.com`)
- traefik.http.routers.netbox-proxy.tls=true
- traefik.http.routers.netbox-proxy.tls.certresolver=mystore
- traefik.http.routers.netbox-proxy.service=netbox
- traefik.http.services.netbox.loadbalancer.server.port=8080
<...>
phpipam-stack (docker compose file) :
<...>
services:
phpipam-web:
image: phpipam/phpipam-www:latest
environment:
- TZ=Europe/Berlin
labels:
- traefik.enable=true
- traefik.http.routers.phpipam-proxy.rule=Host(`phpipam.my-domain.com`)
- traefik.http.routers.phpipam-proxy.tls=true
- traefik.http.routers.phpipam-proxy.tls.certresolver=mystore
#- traefik.http.routers.phpipam-proxy.service=phpipam-web
#- traefik.http.services.phpipam-web.loadbalancer.server.port=80
<...>
I generated the certificates using my own PKI and exported them, along with their private key, to a .pfx file. Next, I converted them using OpenSSL with the following commands to create both a .crt and a .key file:
openssl pkcs12 -in "$Path\$CertName.pfx" -out "$Path\$CertName.crt" -clcerts -nokeys -passin pass:$CertPassword
openssl pkcs12 -in "$Path\$CertName.pfx" -out "$Path\$CertName.key" -nocerts -nodes -passin pass:$CertPassword
Finally, I copied the certificates to the traefik-ca volume.
Regarding my configuration, the main issue now is that Traefik isn’t using my certificates and is displaying the default Traefik certificate. What do I need to change to make my own certificates work with the services?
Log output of docker logs traefik-stack-traefik-reverse-proxy-1 :
see next comment