Я тестирую Whoami и получаю проблему с созданием сертификатов.
Сертификат не создается в файле acme.json, и сайты используют сертификат по умолчанию от Traefik, который навигаторы считают недействительным.
Вот ошибка:
traefik | time="2019-10-14T21:16:15Z" level=error msg="Unable to obtain ACME certificate for domains \"inner-whoami.mysite.com\": unable to generate a certificate for the domains [inner-whoami.mysite.com]: acme: Error -> One or more domains had a problem:\n[inner-whoami.mysite.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from https://inner-whoami.mysite.com/.well-known/acme-challenge/xxxxxxxxxxxxxxxxxxxx [51.75.207.100]: \"Hostname: xxxxxxxxxx\\nIP: 127.0.0.1\\nIP: 172.18.0.2\\nRemoteAddr: 172.18.0.3:55692\\nGET /.well-known/acme-challenge/xxxxxxxxxx\", url: \n" rule="Host(`inner-whoami.mysite.com`)" routerName=inner-whoami-secured providerName=myhttpchallenge.acme
traefik | time="2019-10-14T21:16:17Z" level=debug msg="legolog: [INFO] Unable to deactivate the authorization: https://acme-v02.api.letsencrypt.org/acme/authz-v3/xxxxxxxxxx"
Вот файл docker-compose.yml. Все внутри. Как видите, это тест для подготовки к дальнейшему развертыванию. Не настоящий производственный файл. Мне нужно решить эту проблему, прежде чем я смогу использовать сервер Traefik в масштабах...
version: "3.3"
networks:
# Allow the use of traefik in other docker-compose.yml files
traefik:
external: true
services:
traefik:
image: "traefik:v2.0"
container_name: "traefik"
command:
# Only for development environment
- "--log.level=DEBUG"
- "--api.insecure=true"
# Get Docker as the provider
- "--providers.docker=true"
# Avoid that all containers are exposed
- "--providers.docker.exposedbydefault=false"
# Settle the ports for the entry points
- "--entrypoints.web.address=:80"
- "--entrypoints.web-secure.address=:443"
# Settle the autentification method to http challenge
- "--certificatesresolvers.myhttpchallenge.acme.httpchallenge=true"
- "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web-secure"
# Uncomment this to get a fake certificate when testing
#- "--certificatesresolvers.myhttpchallenge.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
# Settle letsencrypt as the certificate provider
- "[email protected]"
- "--certificatesresolvers.myhttpchallenge.acme.storage=/letsencrypt/acme.json"
ports:
- "80:80"
- "443:443"
- "8080:8080"
networks:
- "traefik"
volumes:
# Store certificates in ./letsencrypt/acme.json
- "./letsencrypt:/letsencrypt"
# Connect to Doker socket
- "/var/run/docker.sock:/var/run/docker.sock:ro"
inner-whoami:
image: "containous/whoami"
container_name: "inner-whoami"
networks:
- "traefik"
labels:
- "traefik.enable=true"
# Get the routes from http
- "traefik.http.routers.inner-whoami.rule=Host(`inner-whoami.mysite.com`)"
- "traefik.http.routers.inner-whoami.entrypoints=web"
# Redirect these routes to https
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.routers.inner-whoami.middlewares=redirect-to-https@docker"
# Get the routes from https
- "traefik.http.routers.inner-whoami-secured.rule=Host(`inner-whoami.mysite.com`)"
- "traefik.http.routers.inner-whoami-secured.entrypoints=web-secure"
# Apply autentificiation with http challenge
- "traefik.http.routers.inner-whoami-secured.tls=true"
- "traefik.http.routers.inner-whoami-secured.tls.certresolver=myhttpchallenge"
