Hello y'all! I am running into an issue with getting a wildcard certificate generated for my subdomains, and I'm sure I'm just not configuring something correctly; any help or advice on what I'm doing wrong is greatly appreciated!
Traefik is running as a Docker container, alongside many other services. These services are accessed via subdomains off my personal domain internally. Here's the basic DNS records created in DigitalOcean:
On my home network there's a PiHole which has the custom DNS entries to redirect the subdomains to the appropriate box internally.
When Traefik starts up I can see log lines which indicate it is attempting to generate a certificate for the different subdomains:
DBG github.com/go-acme/lego/v4@v4.21.0/log/logger.go:48 > [INFO] [dozzle.r****h.com] acme: Waiting for DNS record propagation. lib=lego
And in DigitalOcean I can see that TXT records are created:
But after a minute or so the following error messages appear in my logs:
ERR github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:482 > Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [dozzle.r****h.com]: error: one or more domains had a problem:\n[dozzle.r****h.com] propagation: time limit exceeded: last error: [zone=r***h.com.] could not determine authoritative nameservers\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["dozzle.r***h.com"] providerName=letsencrypt.acme routerName=dozzle@docker rule=Host(dozzle.r****h.com)
My labels for individual services are pretty simple (I'll post a full docker-compose.yml below as well):
- traefik.enable=true
- traefik.http.routers.dozzle.rule=Host(`dozzle.r***h.com`)
Traefik itself is configured with a yaml file, the cert resolver bit looks like this (I'll again attach the full config file below):
entryPoints:
websecure:
address: :443
forwardedHeaders:
insecure: true
http:
tls:
certresolver: letsencrypt
domains:
- main: "r***h.com"
sans:
- "*.r***h.com"
certificatesResolvers:
letsencrypt:
acme:
email: email@email.com
storage: "/acme/acme.json"
dnsChallenge:
provider: digitalocean
delayBeforeCheck: 0
resolvers:
- "ns1.digitalocean.com:53"
- "ns2.digitalocean.com:53"
- "ns3.digitalocean.com:53"
propagation:
delayBeforeChecks: 15s
And when I run dig inside the Traefik container while it's attempting to start up (and the records show as created in DigitalOcean) but it doesn't appear to resolve correctly, however I may also be querying the DNS records incorrectly.
Optimally Traefik will request and use a single certificate for all the wildcard domains on my network. If anyone can see what I'm doing wrong I really appreciate any guidance!! Thank you!
Traefik docker-compose
version: "3"
services:
traefik:
image: traefik:latest
container_name: traefik
env_file: /opt/stacks/traefik/.env
restart: always
ports:
# The HTTP port
- 80:80
- 443:443
- 8080:8080
volumes:
# So that Traefik can listen to the Docker events
- /var/run/docker.sock:/var/run/docker.sock
- /opt/stacks/traefik/traefik.yml:/traefik.yml
- /opt/stacks/traefik/traefik-dynamic.yml:/traefik-dynamic.yml
- /opt/stacks/traefik/acme:/acme
labels:
- traefik.enable=true
- traefik.http.routers.proxy.rule=Host(`traefik.r***h.com`)
- traefik.http.routers.proxy.service=api@internal
networks:
- proxy
networks:
proxy:
external: true
Service docker-compose
services:
dozzle:
container_name: dozzle
image: amir20/dozzle:latest
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock
networks:
- proxy
labels:
- traefik.enable=true
- traefik.http.routers.dozzle.rule=Host(`dozzle.r***h.com`)
networks:
proxy:
external: true
Traefik.yml static config
log:
level: DEBUG
accesslog: true
api:
dashboard: true
insecure: false
entryPoints:
web:
address: :80
forwardedHeaders:
insecure: true
http:
redirections:
entrypoint:
to: websecure
scheme: https
websecure:
address: :443
forwardedHeaders:
insecure: true
http:
tls:
certresolver: letsencrypt
domains:
- main: "r***h.com"
sans:
- "*.r***h.com"
other:
address: ":9090/udp"
certificatesResolvers:
letsencrypt:
acme:
email: email@email.com
storage: "/acme/acme.json"
dnsChallenge:
provider: digitalocean
delayBeforeCheck: 0
resolvers:
- "ns1.digitalocean.com:53"
- "ns2.digitalocean.com:53"
- "ns3.digitalocean.com:53"
propagation:
delayBeforeChecks: 15s
providers:
docker:
watch: true
network: proxy
exposedByDefault: false
file:
filename: "/traefik-dynamic.yml"
Traefik-dynamic.yml dynamic config
http:
middlewares:
simpleAuth:
basicAuth:
users:
- "admin:hashvalue"
