posts/traefik-3-docker-certificates/

[giscus[bot]]

posts/traefik-3-docker-certificates/

In today’s Traefik tutorial we’ll get FREE Wildcard certificates to use in our HomeLab and with all of our internal self-hosted services. We’re going to set up Traefik 3 in Docker and get Let’s Encrypt certificates using Cloudflare as our DNS Provider (we’ll cover how to set up others too). Then we’ll configure local DNS using PiHole (or any other local DNS) to route to our services that are now protected with secure certificates!

https://technotim.live/posts/traefik-3-docker-certificates/

[P1tt187]

I really like your approach. I'm using it for more than a year now and it just works.

I've one improvement for you. In the video you mentiond that you have to register a cname for every service.
If you're using a wildcard certificate why not using a wildcard cname?
Pihole is using dnsmasq. The webinterface of pihole does not allow to set all possible values. But if you configure it from the terminal pihole will recognize rules and respect them.

To achieve this you simply have to modify the pihole volumes.
Assuming you created a folder named pihole-dnsmasq.d and mounted the path /etc/dnsmasq.d
Create file named 02-local-wildcard-dns.conf
simply adding the line cname=*.example.com,default.example.com should do the trick
source

In my case i use an ip address approach.
Therefor can set the following:

address=/local.example.com/192.168.0.10
address=/local.example.com/:::1

It is importand to set the ipv4 and ipv6 entry because windows will work with just the ipv4 rule but linux will try ipv6 first.

[mrsatyp]

Do you know if something like this is doable with pfsense using resolver.. TIA

[Bictonbandit]

Excellent tutorial . Thanks.

I have followed everyt.hing in the video and everything appears to be working fine, BUT, I am not getting ANY SSL certs on the internal browser pages.

Being a relative novice to running a server, I am at a loss to figure out where to start looking to get letsencrypt to send me some certs.

I look forward to any pointers you can send me, so I can fix my almost working traefik system.

Rgds Ken

[timothystewart6]

Check the troubleshooting section in the video! That may help!

[AlphaInfamous]

I was having the same issue, I thought since udm-pro points to AdguardHome for DNS & having example.domain.com pointing to Traefik ip as a dns rewrite in adguard will do the trick without port forwarding but its a dead end.

Need to Port Forward in order to get SSL Certs

[bozhikovstanislav]

I have some troubles.

I install traefik on rosberiPy. but I still get

ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains...

I have acme.sh . and it generates serts from the terminal . but traefik did not do it ?

Any Help

[bozhikovstanislav]

I made it . It was environment variables - I have to use .env instead of secrets

[fenixthebuilder]

I followed the tutorial. Docker doesn't show any logs, which is good, but it doesn't show me the traefik dashboard. I had written the secrets and the .env file, but no luck. What do I do?

[ariewtf]

i have the same issue,
the password prompt appears but it won't authenticate me. the credentials show inside of the container tho.

[ariewtf]

Found the answer here:
https://community.traefik.io/t/basic-auth-not-working-from-env-docker-compose-setup-only-if-hardcoded/20207

Example:
echo $(htpasswd -nbB USER "PASS")

[lordcheeto]

With the redirection on the entrypoint, you don't need the redirect rules in the labels or config.

entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
          permanent: true

[hodgkiss]

I have notice two things:
example.com is not a valid domain for techno Tim links at the end of the article.

I am getting a 404 error still, I have resolved pihole issue but this remains at issue.
I get the redirect visiting the ip address 192.168.. from port 80 to via 301, to port 443 but get 404 error: 404 page not found.

For clarity I am using my own domain and change exmaple.com to my my-site. Computer domain.

Does this have a limit using the tld. .computer as in getting confused with com domains.
I don't have .com domains to play with.

I have repeated the process with the video 3 times to ensure I did not miss a step; the error remains the same.
Each time used a different pi (pi2, pi3, pi4) with 3 different micro SD cards each time.

[AlphaInfamous]

are you seeing certs ? and can you share the traefik log

[mrsatyp]

Now playing around with Authentik, trying to get it to work with traefik...

[hodgkiss]

My logs are empty - the cert is the default traefik one lasting a day.

[mrsatyp]

Firstlly,

Desptie getting errors ONLY on NOT getting any letscrypt certs.. I had lo in say this in absolutely one the best well rounded , well thought, in depth traefik install walk-through I have come accross thus far, just had to had to say it , thanks and well done Tim..

On the off chance anyone has the same issue:

ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [xx.xx.io .xx.xx.io]: error: one or more domains had a problem:\n[.xx.xx.xx] propagation: time limit exceeded: last error: NS xx.ns.cloudflare.com. returned REFUSED for _acme-challenge.xx.xx.io.\n[xx.xx.io] propagation: time limit exceeded: last error: NS xx.ns.cloudflare.com. returned REFUSED for _acme-challenge.xx.xx.io.\n

• I can see the TXT record come through in cloudflare for 2 mins before disappearing and and getting the above message, I know it can't be any port 80 in pfsense as I have tried a rule to specifically allow this with no change.
• I even subscribed to the to $10 pm cloudflare advanced certificates in edge certificates to include the 2nd and 3rd levels domains thinking it might resolve - no joy

Hopefully someone can point out the obvious if they have come across the same message.

[AlphaInfamous]

token issue is what I'm thinking if cd refused

[mrsatyp]

Thanks Alphaine, this worked when I un-commented the 2 long lines at the end of the compose file for whatever reasons, probably needed more time...

I should have updated here.... 😉🤘🙏

[mrsatyp]

Basically I get the traefiic certs and NOT the Letsenscrypt beauties sadly..

[mrsatyp]

Anyone got a decent links showing how to add multiple external links.

I've got my proxmox added as per the video no issues.. Looking to add more starting with Authentik first.

Is it just a case of just adding more ip along with the respective traffic labels in the Config.yml file?

Don't fancy breaking anything just yet 😊🤗

[timothystewart6]

Sure, in this post there's a link to a config file where many have contributed to https://technotim.live/posts/traefik-portainer-ssl/

[mrsatyp]

Will check it out in due course, thanks much appreciated