Traefik 2.2 unable to get letsencrypt certificate

Question

I am having an application with a MongoDB container, a python backend service, a portainer. Traefik is used for routing to portainer and the backend (one API endpoint). The routing works perfectly. However, I want to use SSL, but Traefik 2.2 doesn't fetch the LetsEncrypt certificate.

Dockerfile (I am packing a container, to do a chmod of acme.json)

FROM traefik:v2.2

COPY traefik /etc/traefik

RUN chmod 600 /etc/traefik/acme.json

docker-compose.yml:

version: "3.3"

services:

  backend:
    image: registry.gitlab.com/uuuu/backend:latest
    container_name: backend
    ports:
      - 5000
    environment:
      - CONNECTOR=$CONNECTOR
      - CONNECTOR_MAX_WORKERS=$CONNECTOR_MAX_WORKERS
      - LOGLEVEL=$LOGLEVEL
      - MONGODB_URI=mongodb://scraper-db/blubb
    depends_on: 
      - db
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.backend.rule=Host(`app.mydomain.com`)'
      - 'traefik.http.routers.backend.rule=PathPrefix(`/api/bla/`)'
      - 'traefik.http.routers.backend.tls=true'
      - 'traefik.http.routers.backend.tls.certresolver=lets-encrypt'
      - "traefik.http.routers.backend.middlewares=autocompletionreplacer"
      - "traefik.http.middlewares.autocompletionreplacer.replacepathregex.regex=^/api/bla/(.*)"
      - "traefik.http.middlewares.autocompletionreplacer.replacepathregex.replacement=/$$1"

  portainer:
    image: portainer/portainer:latest
    container_name: portainer
    ports:
      - 9000
    volumes:
      - /etc/localtime:/etc/localtime
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`app.mydomain.com`)"
      - 'traefik.http.routers.portainer.rule=PathPrefix(`/portainer/`)'
      - 'traefik.http.routers.portainer.tls=true'
      - 'traefik.http.routers.portainer.tls.certresolver=lets-encrypt'
      - "traefik.http.routers.portainer.middlewares=portainerreplacer"
      - "traefik.http.middlewares.portainerreplacer.replacepathregex.regex=^/portainer/(.*)"
      - "traefik.http.middlewares.portainerreplacer.replacepathregex.replacement=/$$1"
  
  proxy:
    image: my-proxy:latest  
    restart: always
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - ./traefik:/etc/traefik:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    build: .
    
  db:
    image: mongo:3.7
    container_name: db
    ports:
      - 27017

/etc/traefik/traefik.toml:

[log]
  level = "DEBUG"

[providers]
  [providers.docker]
    exposedByDefault = false
  [providers.file]
    directory = "/etc/traefik/dynamic"

[entryPoints]
  [entryPoints.http]
    address = ":80"
  [entryPoints.https]
    address = ":443"

[certificatesResolvers.lets-encrypt.acme]
  storage = "/etc/traefik/acme.json"
  email = "[email protected]"
  [certificatesResolvers.lets-encrypt.acme.tlsChallenge]

/etc/traefik/dynamic/force-https.toml:

[http.routers]
  [http.routers.force-https]
    entryPoints = ["http"]
    middlewares = ["force-https"]
    rule = "HostRegexp(`{any:.+}`)"
    service = "noop"

[http.middlewares]
  [http.middlewares.force-https.redirectScheme]
    scheme = "https"

[http.services]
  [http.services.noop.loadBalancer]

I don't see any error in the logs. However I am getting this in the browser:

ea351828037eb97754d6ed00d36a2108.e645b5289e7388055e4ecd78af554f8.traefik.default.
 
Fehlercode: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

Is there anything I am missing?

Answer 1

I figured it out by myself. I had to add this to the docker-compose file for each service:

traefik.http.routers.fiverr-autocompletion.tls.domains[0].main=app.mydomain.com

The correct docker-compose looks like this then:

version: "3.3"

services:

  backend:
    image: registry.gitlab.com/uuuu/backend:latest
    container_name: backend
    ports:
      - 5000
    environment:
      - CONNECTOR=$CONNECTOR
      - CONNECTOR_MAX_WORKERS=$CONNECTOR_MAX_WORKERS
      - LOGLEVEL=$LOGLEVEL
      - MONGODB_URI=mongodb://scraper-db/blubb
    depends_on: 
      - db
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.backend.rule=Host(`app.mydomain.com`)'
      - 'traefik.http.routers.backend.rule=PathPrefix(`/api/bla/`)'
      - 'traefik.http.routers.backend.tls.domains[0].main=app.mydomain.com'
      - 'traefik.http.routers.backend.tls=true'
      - 'traefik.http.routers.backend.tls.certresolver=lets-encrypt'
      - "traefik.http.routers.backend.middlewares=autocompletionreplacer"
      - "traefik.http.middlewares.autocompletionreplacer.replacepathregex.regex=^/api/bla/(.*)"
      - "traefik.http.middlewares.autocompletionreplacer.replacepathregex.replacement=/$$1"

  portainer:
    image: portainer/portainer:latest
    container_name: portainer
    ports:
      - 9000
    volumes:
      - /etc/localtime:/etc/localtime
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`app.mydomain.com`)"
      - 'traefik.http.routers.portainer.rule=PathPrefix(`/portainer/`)'
      - 'traefik.http.routers.portainer.tls.domains[0].main=app.mydomain.com'
      - 'traefik.http.routers.portainer.tls=true'
      - 'traefik.http.routers.portainer.tls.certresolver=lets-encrypt'
      - "traefik.http.routers.portainer.middlewares=portainerreplacer"
      - "traefik.http.middlewares.portainerreplacer.replacepathregex.regex=^/portainer/(.*)"
      - "traefik.http.middlewares.portainerreplacer.replacepathregex.replacement=/$$1"
  
  proxy:
    image: my-proxy:latest  
    restart: always
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - ./traefik:/etc/traefik:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    build: .
    
  db:
    image: mongo:3.7
    container_name: db
    ports:
      - 27017
/etc/traefik/traefik.toml: