How do I configure Traefik to use ACME for certificate signing?

[manuelcanepa]

Im trying to setup the acme configuration to auto-sign with let's encrypt. After editing my docker-compose.yml (#531) and starting the environment, traefik logs shows an error:

level=error msg="the router homeassistant@docker uses a non-existent resolver: myresolver"

I follow all the steps on traefik documentation and still getting this error.

/opt/warden/docker/docker-compose.yml:

[...]
    container_name: traefik
    image: traefik:${TRAEFIK_VERSION:-2.2}
    command:
      - "--log.level=info"
      - "--api.insecure=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=....."
      - "--certificatesresolvers.myresolver.acme.storage=acme.json"
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
[...]

Has anyone been able to resolve this issue?

[navarr]

Can you show your homeassistant@docker config?

[manuelcanepa]

Can you show your homeassistant@docker config?

Yes, of course:

  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    privileged: true
    restart: unless-stopped
    environment:
      - TZ=America/Argentina/Buenos_Aires
    volumes:
      - ./config:/config
      - /etc/localtime:/etc/localtime:ro
      - /var/run/dbus/:/run/dbus/:z
    expose:
      - 8123

    labels:
      # DUCKDNS
      - traefik.enable=true
      - traefik.http.routers.${WARDEN_ENV_NAME}.tls=true
      - traefik.http.routers.${WARDEN_ENV_NAME}.tls.certresolver=myresolver
      - traefik.http.routers.${WARDEN_ENV_NAME}.priority=4
      - traefik.http.routers.${WARDEN_ENV_NAME}.rule=Host(`privatedomain.duckdns.org`)
      # LOCAL DOMAIN
      - traefik.http.routers.${WARDEN_ENV_NAME}-local.tls=true
      - traefik.http.routers.${WARDEN_ENV_NAME}-local.priority=4
      - traefik.http.routers.${WARDEN_ENV_NAME}-local.rule=Host(`${TRAEFIK_SUBDOMAIN}.${TRAEFIK_DOMAIN}`)
      - traefik.http.services.${WARDEN_ENV_NAME}.loadbalancer.server.port=8123
      - traefik.frontend.whiteList.useXForwardedFor=true

Edit: Remove uncommented " - traefik.http.services.${WARDEN_ENV_NAME}.loadbalancer.server.port=8080"

[manuelcanepa]

Well, finally i make it works. Instead of editing the docker-compose.yml file, i makes some changes on /opt/warden/config/traefik/traefik.yml
Adding the next lines on bottom:

certificatesResolvers:
  letsencrypt:
    acme:
      email: xxxxx@gmail.com
      storage: /etc/traefik/letsencrypt-acme.json
      caServer: https://acme-v02.api.letsencrypt.org/directory
      dnsChallenge:
        provider: duckdns
        resolvers:
          - "1.1.1.1:53"
          - "8.8.8.8:53"

And adding this labels to the warden-env.yml of the project file:

      - traefik.http.routers.${WARDEN_ENV_NAME}.tls=true
      - traefik.http.routers.${WARDEN_ENV_NAME}.tls.certresolver=letsencrypt
      - traefik.http.routers.${WARDEN_ENV_NAME}.priority=4
      - traefik.http.routers.${WARDEN_ENV_NAME}.rule=Host(`example.duckdns.org`)