Dear Developers, Community,
Thank you for the marvel!
I am trying to configure a Docker Compose container for a subdomain and HTTPS route.
For some unknown reason, Traefik successfully gets and stores a cert for the main domain but for a subdomain that is for the container: pic.example.com.
As you may see in the Traefik logs below, it keeps telling that the cert is not required and serves the default for unknown reason.
The file acme.json contains a cert for only the main domain (e.g. example.com), and I've already tried cleaning the file and restarting the Traefik.
What might it be? Why would it serve the default only?
Best and kind regards
Supplementary
Traefik Logs
2025-07-20T10:56:36Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:105 > Traefik version 3.4.4 built on 2025-07-11T08:31:57Z version=3.4.4
2025-07-20T10:56:36Z DBG github.com/traefik/traefik/v3/cmd/traefik/traefik.go:112 > Static configuration loaded [json] staticConfiguration={"accessLog":{"fields":{"defaultMode":"keep","headers":{"defaultMode":"keep","names":{"Authorization":"redact"}},"names":{"ClientUsername":"drop","DownstreamContentSize":"drop","DownstreamStatus":"drop","Overhead":"drop","ServiceURL":"drop"}},"filePath":"/var/log/traefik/access.log","filters":{"minDuration":"10ms"},"format":"json"},"api":{"basePath":"/","dashboard":true,"debug":true,"insecure":true},"certificatesResolvers":{"lets-encrypt":{"acme":{"caServer":"https://acme-v02.api.letsencrypt.org/directory","certificatesDuration":2160,"email":"user@gmail.com","httpChallenge":{"entryPoint":"http"},"keyType":"RSA4096","preferredChain":"ISRG Root X1","storage":"/resolvers/acme.json"}}},"entryPoints":{"http":{"address":":80","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"https":{"address":":443","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true,"tls":{"certResolver":"lets-encrypt"}},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"traefik":{"address":":8111","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}}},"experimental":{"plugins":{"rewriteHeadersTP":{"moduleName":"github.com/bitrvmpd/traefik-plugin-rewrite-headers","settings":{},"version":"v0.0.1"}}},"global":{"checkNewVersion":true},"log":{"compress":true,"filePath":"/var/log/traefik/traefik.log","format":"common","level":"TRACE","maxAge":7,"maxBackups":10},"providers":{"docker":{"defaultRule":"Host(`{{ normalize .Name }}`)","endpoint":"unix:///var/run/docker.sock","httpClientTimeout":"1h23m20s","network":"reverse-proxy","watch":true},"file":{"directory":"/opt/config/traefik/providers","watch":true},"providersThrottleDuration":"2s"},"serversTransport":{"insecureSkipVerify":true,"maxIdleConnsPerHost":200},"tcpServersTransport":{"dialKeepAlive":"15s","dialTimeout":"30s"}}
2025-07-20T10:56:36Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:634 >
Stats collection is disabled.
Help us improve Traefik by turning this feature on :)
More details on: https://doc.traefik.io/traefik/contributing/data-collection/
2025-07-20T10:56:36Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:239 > Loading plugins... plugins=["rewriteHeadersTP"]
2025-07-20T10:56:36Z DBG github.com/traefik/traefik/v3/pkg/plugins/plugins.go:30 > Loading of plugin: rewriteHeadersTP: github.com/bitrvmpd/traefik-plugin-rewrite-headers@v0.0.1
2025-07-20T10:56:36Z DBG github.com/hashicorp/go-retryablehttp@v0.7.7/client.go:661 > Performing request method=GET url=https://plugins.traefik.io/public/download/github.com/bitrvmpd/traefik-plugin-rewrite-headers/v0.0.1
2025-07-20T10:56:39Z DBG github.com/hashicorp/go-retryablehttp@v0.7.7/client.go:661 > Performing request method=GET url=https://plugins.traefik.io/public/validate/github.com/bitrvmpd/traefik-plugin-rewrite-headers/v0.0.1
2025-07-20T10:56:39Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:249 > Plugins loaded. plugins=["rewriteHeadersTP"]
2025-07-20T10:56:39Z INF github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:73 > Starting provider aggregator *aggregator.ProviderAggregator
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:222 > Starting TCP Server entryPointName=http
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:222 > Starting TCP Server entryPointName=https
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:222 > Starting TCP Server entryPointName=traefik
2025-07-20T10:56:39Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *file.Provider
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *file.Provider provider configuration config={"directory":"/opt/config/traefik/providers","watch":true}
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 > add watcher on: /opt/config/traefik/providers
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 > add watcher on: /opt/config/traefik/providers/middlewares.yaml
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 > add watcher on: /opt/config/traefik/providers/routers.yaml
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 > add watcher on: /opt/config/traefik/providers/services.yaml
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 > add watcher on: /opt/config/traefik/providers/tls.yaml
2025-07-20T10:56:39Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *traefik.Provider
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *traefik.Provider provider configuration config={}
2025-07-20T10:56:39Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *acme.ChallengeTLSALPN
2025-07-20T10:56:39Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *docker.Provider
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *acme.ChallengeTLSALPN provider configuration config={}
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *docker.Provider provider configuration config={"defaultRule":"Host(`{{ normalize .Name }}`)","endpoint":"unix:///var/run/docker.sock","httpClientTimeout":"1h23m20s","network":"reverse-proxy","watch":true}
2025-07-20T10:56:39Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *acme.Provider
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *acme.Provider provider configuration config={"HTTPChallengeProvider":{},"ResolverName":"lets-encrypt","TLSChallengeProvider":{},"caServer":"https://acme-v02.api.letsencrypt.org/directory","certificatesDuration":2160,"email":"user@gmail.com","httpChallenge":{"entryPoint":"http"},"keyType":"RSA4096","preferredChain":"ISRG Root X1","storage":"/resolvers/acme.json","store":{}}
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:234 > Attempt to renew certificates "720h0m0s" before expiry and check every "24h0m0s" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=lets-encrypt.acme
2025-07-20T10:56:39Z INF github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:890 > Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=lets-encrypt.acme
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"middlewares":{"redirect-to-https":{"redirectScheme":{"port":"443","scheme":"https"}},"redirect-to-main-host":{"redirectRegex":{"permanent":true,"regex":".+","replacement":"https://example.com"}}},"routers":{"catchall":{"entryPoints":["http","https"],"middlewares":["redirect-to-https"],"priority":1,"rule":"HostRegexp(`{host:.+}`)","service":"noop@internal"}}},"tcp":{},"tls":{"stores":{"default":{},"example-com":{"defaultGeneratedCert":{"domain":{"main":"example.com"},"resolver":"lets-encrypt"}}}},"udp":{}} providerName=file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"middlewares":{"dashboard_redirect":{"redirectRegex":{"permanent":true,"regex":"^(http:\\/\\/(\\[[\\w:.]+\\]|[\\w\\._-]+)(:\\d+)?)\\/$","replacement":"${1}/dashboard/"}},"dashboard_stripprefix":{"stripPrefix":{"prefixes":["/dashboard/","/dashboard"]}}},"models":{"https":{"observability":{},"tls":{"certResolver":"lets-encrypt"}}},"routers":{"acme-http":{"entryPoints":["http"],"priority":9223372036854775807,"rule":"PathPrefix(`/.well-known/acme-challenge/`)","ruleSyntax":"default","service":"acme-http@internal"},"api":{"entryPoints":["traefik"],"priority":9223372036854775806,"rule":"PathPrefix(`/api`)","ruleSyntax":"default","service":"api@internal"},"dashboard":{"entryPoints":["traefik"],"middlewares":["dashboard_redirect@internal","dashboard_stripprefix@internal"],"priority":9223372036854775805,"rule":"PathPrefix(`/`)","ruleSyntax":"default","service":"dashboard@internal"},"debug":{"entryPoints":["traefik"],"priority":9223372036854775806,"rule":"PathPrefix(`/debug`)","ruleSyntax":"default","service":"api@internal"}},"serversTransports":{"default":{"insecureSkipVerify":true,"maxIdleConnsPerHost":200}},"services":{"acme-http":{},"api":{},"dashboard":{},"noop":{}}},"tcp":{"serversTransports":{"default":{"dialKeepAlive":"15s","dialTimeout":"30s"}}},"tls":{},"udp":{}} providerName=internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{},"tcp":{},"tls":{},"udp":{}} providerName=lets-encrypt.acme
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/docker/pdocker.go:90 > Provider connection established with docker 24.0.2 (API 1.43) providerName=docker
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/docker/config.go:185 > Filtering disabled container container=traefik-traefik-9ec2560a315e6a562f07d275191e830a98832395f91485d175fd971ad58bced1 providerName=docker
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/docker/config.go:185 > Filtering disabled container container=database-nginx-0679df409b85dc216e6585f13be85a57bee650802d3bc0cefe6d4776570ff44f providerName=docker
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"routers":{"nginx":{"entryPoints":["http","https"],"priority":2,"rule":"Host(`pic.example.com`)","service":"nginx"}},"services":{"nginx":{"loadBalancer":{"passHostHeader":true,"responseForwarding":{"flushInterval":"100ms"},"servers":[{"url":"http://192.168.176.2:12345"}],"strategy":"wrr"}}}},"tcp":{},"tls":{},"udp":{}} providerName=docker
2025-07-20T10:56:39Z ERR github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:138 > Error while creating certificate store error="unable to find certificate for domains \"example.com\": falling back to the internal generated certificate" tlsStoreName=example-com@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/stripprefix/strip_prefix.go:32 > Creating middleware entryPointName=traefik middlewareName=dashboard_stripprefix@internal middlewareType=StripPrefix routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=traefik middlewareName=dashboard_stripprefix@internal routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_regex.go:17 > Creating middleware entryPointName=traefik middlewareName=dashboard_redirect@internal middlewareType=RedirectRegex routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_regex.go:18 > Setting up redirection from ^(http:\/\/(\[[\w:.]+\]|[\w\._-]+)(:\d+)?)\/$ to ${1}/dashboard/ entryPointName=traefik middlewareName=dashboard_redirect@internal middlewareType=RedirectRegex routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=traefik middlewareName=dashboard_redirect@internal routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=traefik middlewareName=traefik-internal-recovery middlewareType=Recovery
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_scheme.go:29 > Creating middleware entryPointName=http middlewareName=redirect-to-https@file middlewareType=RedirectScheme routerName=catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_scheme.go:30 > Setting up redirection to https 443 entryPointName=http middlewareName=redirect-to-https@file middlewareType=RedirectScheme routerName=catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=http middlewareName=traefik-internal-recovery middlewareType=Recovery
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_scheme.go:29 > Creating middleware entryPointName=https middlewareName=redirect-to-https@file middlewareType=RedirectScheme routerName=https-catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_scheme.go:30 > Setting up redirection to https 443 entryPointName=https middlewareName=redirect-to-https@file middlewareType=RedirectScheme routerName=https-catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=https middlewareName=traefik-internal-recovery middlewareType=Recovery
2025-07-20T10:56:39Z WRN github.com/traefik/traefik/v3/pkg/server/router/tcp/manager.go:182 > No domain found in rule HostRegexp(`{host:.+}`), the TLS options applied for this router will depend on the SNI of each request entryPointName=https routerName=https-catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:468 > No domain parsed in provider ACME ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=lets-encrypt.acme routerName=https-catchall@file rule=HostRegexp(`{host:.+}`)
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:607 > Default ACME certificate generation is not required. ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=lets-encrypt.acme tlsStoreName=example-com@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/tls/certificate.go:132 > Adding certificate for domain(s) example.com
2025-07-20T10:56:39Z ERR github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:138 > Error while creating certificate store error="unable to find certificate for domains \"example.com\": falling back to the internal generated certificate" tlsStoreName=example-com@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:320 > Creating load-balancer entryPointName=http routerName=nginx@docker serviceName=nginx@docker
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:363 > Creating server URL=http://192.168.176.2:12345 entryPointName=http routerName=nginx@docker serverIndex=0 serviceName=nginx@docker
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_scheme.go:29 > Creating middleware entryPointName=http middlewareName=redirect-to-https@file middlewareType=RedirectScheme routerName=catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_scheme.go:30 > Setting up redirection to https 443 entryPointName=http middlewareName=redirect-to-https@file middlewareType=RedirectScheme routerName=catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=http middlewareName=traefik-internal-recovery middlewareType=Recovery
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/stripprefix/strip_prefix.go:32 > Creating middleware entryPointName=traefik middlewareName=dashboard_stripprefix@internal middlewareType=StripPrefix routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=traefik middlewareName=dashboard_stripprefix@internal routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_regex.go:17 > Creating middleware entryPointName=traefik middlewareName=dashboard_redirect@internal middlewareType=RedirectRegex routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_regex.go:18 > Setting up redirection from ^(http:\/\/(\[[\w:.]+\]|[\w\._-]+)(:\d+)?)\/$ to ${1}/dashboard/ entryPointName=traefik middlewareName=dashboard_redirect@internal middlewareType=RedirectRegex routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=traefik middlewareName=dashboard_redirect@internal routerName=dashboard@internal
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=traefik middlewareName=traefik-internal-recovery middlewareType=Recovery
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_scheme.go:29 > Creating middleware entryPointName=https middlewareName=redirect-to-https@file middlewareType=RedirectScheme routerName=https-catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_scheme.go:30 > Setting up redirection to https 443 entryPointName=https middlewareName=redirect-to-https@file middlewareType=RedirectScheme routerName=https-catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=https middlewareName=traefik-internal-recovery middlewareType=Recovery
2025-07-20T10:56:39Z WRN github.com/traefik/traefik/v3/pkg/server/router/tcp/manager.go:182 > No domain found in rule HostRegexp(`{host:.+}`), the TLS options applied for this router will depend on the SNI of each request entryPointName=https routerName=https-catchall@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/server/router/tcp/manager.go:237 > Adding route for pic.example.com with TLS options default entryPointName=https
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:468 > No domain parsed in provider ACME ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=lets-encrypt.acme routerName=https-catchall@file rule=HostRegexp(`{host:.+}`)
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:472 > Trying to challenge certificate for domain [pic.example.com] found in HostSNI rule ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=lets-encrypt.acme routerName=https-nginx@docker rule=Host(`pic.example.com`)
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:607 > Default ACME certificate generation is not required. ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=lets-encrypt.acme tlsStoreName=example-com@file
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:946 > Looking for provided certificate(s) to validate ["pic.example.com"]... ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=lets-encrypt.acme routerName=https-nginx@docker rule=Host(`pic.example.com`)
2025-07-20T10:56:39Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:990 > No ACME certificate generation required for domains ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["pic.example.com"] providerName=lets-encrypt.acme routerName=https-nginx@docker rule=Host(`pic.example.com`)
2025-07-20T10:56:41Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 > Serving default certificate for request: "pic.example.com"
2025-07-20T10:56:41Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:175 > Service selected by WRR: http://192.168.176.2:12345
Service Docker Compose File
services:
nginx:
image: nginx
volumes:
- '/etc/localtime:/etc/localtime:ro'
ports:
- '12345:12345'
depends_on:
- redis
- database
networks:
- web
- reverse-proxy
labels:
- 'traefik.enable=true'
- 'traefik.http.routers.nginx.service=nginx'
- 'traefik.http.routers.nginx.rule=Host(`pic.example.com`)'
- 'traefik.http.routers.nginx.entrypoints=http,https'
- 'traefik.http.routers.nginx.priority=2'
- 'traefik.http.routers.nginx.middlewares=redirect-to-https@file'
# - 'traefik.http.routers.nginx.tls=false'
- 'traefik.http.routers.nginx.tls.certresolver=lets-encrypt'
- 'traefik.http.services.nginx.loadbalancer.server.port=12345'
database:
image: postgres:14
restart: unless-stopped
environment:
POSTGRES_PASSWORD: test
POSTGRES_USER: test
POSTGRES_DB: test
POSTGRES_INITDB_ARGS: '--data-checksums'
networks:
- web
healthcheck:
test: pg_isready -h 127.0.0.1 -d test -U test
interval: 10s
timeout: 5s
retries: 10
start_period: 20s
redis:
image: redis
networks:
- web
healthcheck:
test: redis-cli ping || exit 1
networks:
web:
reverse-proxy:
name: 'reverse-proxy'
external: true
Update #1 (Reason)
Traefik Docker Compose File
services:
traefik:
image: traefik
volumes:
- '/var/docker/data/traefik/traefik/config/traefik.yaml:/traefik.yaml:ro'
- '/var/docker/data/traefik/traefik/config/providers:/opt/config/traefik/providers:ro'
- '/var/docker/data/traefik/traefik/config/resolvers/acme.json:/resolvers/acme.json'
- '/var/docker/data/traefik/traefik/log:/var/log/traefik'
- '/var/docker/data/traefik/traefik/tls/certs/cert.pem:/opt/traefik/tls/certs/cert.pem:ro'
- '/var/docker/data/traefik/traefik/tls/private/key.pem:/opt/traefik/tls/private/key.pem:ro'
- '/var/run/docker.sock:/var/run/docker.sock:ro'
networks:
- 'reverse-proxy'
ports:
- '127.0.0.1:8111:8111'
- '443:443'
- '80:80'
extra_hosts:
- 'host.docker.internal:172.17.0.1'
networks:
reverse-proxy:
name: reverse-proxy
external: true
Traefik Static Config
Traefik container file: /traefik.yaml:
# Static Traefik Configuration File
#
# @see https://doc.traefik.io/traefik/v2.0/reference/static-configuration/file
# ////////////////////////////////////////////////////////////////
global:
checkNewVersion: true
sendAnonymousUsage: false
serversTransport:
insecureSkipVerify: true
# API
# ----------------------------------------------------------------
api:
insecure: true
dashboard: true
debug: true
# Logs
# ----------------------------------------------------------------
log:
filePath: '/var/log/traefik/traefik.log'
# level: 'DEBUG'
level: 'TRACE'
maxBackups: 10
maxAge: 7
compress: true
# @see https://github.com/traefik/traefik/blob/master/pkg/middlewares/accesslog/logdata.go
# @see https://doc.traefik.io/traefik/observability/access-logs/#limiting-the-fieldsincluding-headers
# @see https://community.traefik.io/t/access-logs-pass-custom-headers/18591/2
accessLog:
filePath: '/var/log/traefik/access.log'
format: json
filters:
minDuration: '10ms'
fields:
defaultMode: keep
names:
ClientUsername: drop
DownstreamContentSize: drop
DownstreamStatus: drop
Overhead: drop
ServiceURL: drop
headers:
defaultMode: keep
names:
Authorization: redact
# Certificate Resolvers
#
# @see https://doc.traefik.io/traefik/https/acme/#certificate-resolvers
# ----------------------------------------------------------------
certificatesResolvers:
lets-encrypt:
acme:
email: 'user@gmail.com'
storage: '/resolvers/acme.json'
preferredChain: 'ISRG Root X1'
keyType: 'RSA4096'
httpChallenge:
entryPoint: 'http'
# Providers
#
# @see https://doc.traefik.io/traefik/v2.0/providers
# ----------------------------------------------------------------
providers:
file:
directory: '/opt/config/traefik/providers'
watch: true
docker:
endpoint: 'unix:///var/run/docker.sock'
watch: true
network: 'reverse-proxy'
exposedByDefault: false
httpClientTimeout: 5000
# Entrypoints
#
# @see https://doc.traefik.io/traefik/routing/entrypoints
# ----------------------------------------------------------------
entryPoints:
http:
address: ':80'
https:
address: ':443'
http:
tls:
certResolver: 'lets-encrypt'
traefik:
address: ':8111'
defaultEntryPoints:
- 'http'
- 'https'
# Plugins
# ----------------------------------------------------------------
experimental:
plugins:
# @see https://plugins.traefik.io/plugins/63718c14c672f04dd500d1a0/rewrite-headers
rewriteHeadersTP:
moduleName: 'github.com/bitrvmpd/traefik-plugin-rewrite-headers'
version: 'v0.0.1'
Traefik Provider Dynamic Configs
Middlewares
Traefik container file: /opt/config/traefik/providers/middlewares.yaml:
http:
middlewares:
redirect-to-https:
redirectScheme:
port: '443'
scheme: 'https'
permanent: false
Routers
Traefik container file: /opt/config/traefik/providers/routers.yaml:
http:
routers:
catchall:
rule: 'HostRegexp(`{host:.+}`)'
service: 'noop@internal'
priority: 1
entrypoints:
- 'http'
# Mayhaps, not required.
- 'https'
middlewares:
- 'redirect-to-https'
TLS
Traefik container file: /opt/config/traefik/providers/tls.yaml:
# TLS
# @see https://doc.traefik.io/traefik/https/tls/#acme-default-certificate
tls:
stores:
serious-su:
defaultGeneratedCert:
resolver: 'lets-encrypt'
domain:
main: 'example.com'
default:
# If invalid, should result in 'ERR_SSL_UNRECOGNIZED_NAME_ALERT'.
# @see https://www.rfc-editor.org/rfc/rfc4366#section-4 ("unrecognized_name")
defaultCertificate:
certFile: '/opt/traefik/tls/certs/cert.pem'
keyFile: '/opt/traefik/tls/private/key.pem'