Traefik always throws 404 for secure only connections. Its so weird reddit / selfhosted ---------------------------------------------------------------------- __4di__ · 2023-12-30 16:38 So I wanted to move from npm to traefik for security reasons. I found a good online blog for an initial setup of traefik. It works, but not really. and for the love of god, i cant figure out why. I unfortunately cannot seem to post in the r/Traefik subreddit because of my low karma :(. Here is my docker-compose.yml: services: traefik: image: traefik:v2.10 container_name: traefik restart: always networks: - proxy ports: - 80:80 - 8080:8080 - 443:443 volumes: - /etc/localtime:/etc/localtime:ro - /var/run/docker.sock:/var/run/docker.sock:ro - ./data/traefik.yml:/traefik.yml:ro - ./data/configs:/configs:ro - ./data/acme.json:/acme.json:rw - ./data/logs:/logs:rw environment: - CF_DNS_API_TOKEN=${CFAPI} read_only: true security_opt: - no-new-privileges=true labels: - traefik.enable=true - traefik.http.routers.traefik-https.entrypoints=websecure - traefik.http.routers.traefik- https.rule=Host(`traefik.example.com`) - traefik.http.middlewares.traefik- auth.basicauth.users=${TRAEFIKADMIN} - traefik.http.routers.traefik-https.middlewares=traefik- auth - traefik.http.routers.traefik-https.service=api@internal - traefik.http.routers.traefik-https.tls=true - traefik.http.routers.traefik- https.tls.certresolver=letsencrypt - traefik.http.routers.traefik- https.tls.domains[0].main=example.com - traefik.http.routers.traefik- https.tls.domains[0].sans=*.example.com whoami: image: containous/whoami:latest container_name: whoami hostname: whoami restart: unless-stopped networks: - proxy labels: - traefik.enable=true - traefik.http.routers.whoami-https.entrypoints=websecure - traefik.http.routers.whoami- https.rule=Host(`whoami.example.com`) #- traefik.http.routers.whoami-https.service=whoami - traefik.http.services.whoami- https.loadbalancer.server.port=80 - traefik.http.routers.whoami-https.tls=true - traefik.http.routers.whoami- https.tls.certresolver=letsencrypt networks: proxy: external: {} and the static configuration file (traefik.yml) looks like: api: dashboard: true insecure: true debug: true entryPoints: web: address: ":80" websecure: address: ":443" http: tls: {} providers: docker: endpoint: "unix:///var/run/docker.sock" exposedByDefault: false defaultRule: "Host(`{{ index .Labels \"com.docker.compose.service\"}}.example.com`)" network: proxy file: directory: "/configs" watch: true certificatesResolvers: http: acme: email: cert@example.com storage: acme.json httpChallenge: entryPoint: web letsencrypt: acme: email: cert@example.com storage: acme.json dnsChallenge: provider: cloudflare resolvers: - "1.1.1.1:53" - "8.8.8.8:53" #serversTransport: # insecureSkipVerify: false accessLog: filePath: "/logs/access.log" fields: headers: names: User-Agent: keep log: filePath: "/logs/traefik.log" level: INFO Now when I get the stack up and running, I can never access the following: 1. https://traefik.example.com \--> 404 2. https://serverip:443 --> 404 3. http://serverip:80 --> 404 4. https://whoami.example.com \--> 404 But i can access the traefik dashboard only insecurely at http://serverip:8080 because i have set insecure=true. Is there no way to reach the dashboard securely?! what am i doing wrong? I dont see any error in the log files or in the dashboard. Now to the services themselves, when i remove the line - traefik.http.routers.whoami-https.entrypoints=websecure , I can access both: 1. http://whoami.example.com 2. https://whoami.example.com I simply want to reach both traefik dashboard and my services only with websecure. But it just doesnt seem to work. I am pulling my hairout as to what is traefik doing and what am i doing wrong? Any help is very much appreciated! Thanks! ---------------------------------------------------------------------- bufandatl · 2023-12-30 17:09 Enable higher logging verbosity and check logs what issues traefik has with your definitions. ---------------------------------------------------------------------- __4di__ · 2023-12-30 17:44 hmm, i switched to level DEBUG, but there is nothing that stands out in the logs. or atleast I am not proficient enough to look for something specific. Is there something specific that would give me any useful info? ---------------------------------------------------------------------- bufandatl · 2023-12-30 17:49 There should be a line that contains error when traefik encounters an error in config. If nothing comes up that would be unfortunate. Then it will get harder to debug anything. ---------------------------------------------------------------------- __4di__ · 2023-12-30 17:51 there is no error :/ the dashboard shows the router connection succeeded. but when i open the site, it simply says 404 page not found ---------------------------------------------------------------------- bufandatl · 2023-12-30 17:52 Hm. If the router and service is ok. Then the 404 might be from the other container. ---------------------------------------------------------------------- __4di__ · 2023-12-30 17:56 its a toy whoami container. but on top of that, even the traefik dahsboard is inaccessible at 443. and weirdly the whoami service works when i dont specify which endpoint to use. but the problem is, i can then access my service both securely and insecurely which i dont want. ---------------------------------------------------------------------- bufandatl · 2023-12-30 17:59 Then define a middleware to rewrite to https for http. here is a config of my Heimdall dashbaord. ``` trafik.enable: "true" traefik.http.routers.heimdall.rule: "Host(`{{ traefik_host }}`)" traefik.http.routers.heimdall.middlewares: redirect-ssl traefik.http.middlewares.redirect-ssl.redirectScheme.scheme: https traefik.http.middlewares.redirect-ssl.redirectScheme.permanent: "true" traefik.http.routers.heimdall.entryPoints: http traefik.http.routers.heimdall-secure.entryPoints: https traefik.http.routers.heimdall-secure.rule: "Host(`{{ traefik_host }}`)" traefik.http.routers.heimdall-secure.middlewares: sslheaders traefik.http.middlewares.sslheaders.headers.STSSeconds: "31536000" traefik.http.middlewares.sslheaders.headers.STSIncludeSubdomains: "true" traefik.http.middlewares.sslheaders.headers.STSPreload: "true" traefik.http.routers.heimdall-secure.tls.certresolver: certresolver ``` ---------------------------------------------------------------------- __4di__ · 2023-12-30 18:09 wow, okay that works! thanks a lot!! But i am still weirded out by the fact that i cant define a entrypoint. and cant access the dashboard securely. ---------------------------------------------------------------------- bufandatl · 2023-12-30 18:15 Hm..I have check your config and compared to my dashboard only difference I got is I defined both entrypoints and when I du a curl on my Dashboard with http:// then I get a 301 Moved permanently with https://. I guess traefik does some stuff internally. Here is my config for the dashboard. ``` trafik.enable: "true" traefik.http.routers.dashboard.rule: "Host(`{{ traefik_host }}`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))" traefik.http.routers.dashboard.service: api@internal traefik.http.routers.dashboard.middlewares: auth traefik.http.routers.dashboard.tls: "true" traefik.http.routers.dashboard.tls.certresolver: certresolver traefik.http.routers.dashboard.entrypoints: "http, https" traefik.http.middlewares.auth.basicauth.users: "{{ traefik_dashboard_user_pass }}" ``` ---------------------------------------------------------------------- __4di__ · 2023-12-30 18:15 wth, even my traefik dashboiard is now accessible securely. okay, im not gonna complain and take this win. Thanks a lot again!! ---------------------------------------------------------------------- Jelly_292 · 2023-12-31 19:11 Middleware to rewrite is fine, but setting this as a default at the entrypoint level is a better way. https://doc.traefik.io/traefik/routing/entrypoints/#redirection