0

Context

I've a "particular" setup where I have a first frontend server (server0) that receive all public web traffic and at least one another host (server1) on a private network only.

I don't know how to enable HTTPS for services hosted on private network host(s) (server1).

Here's a scheme of my architecture:


[ Internet ] --- [ Server 0 ]              --- [ Server 1]
                 +-----------------------+     +-----------------------+
                 | Docker                |     | Docker                |
                 | +-------------------+ |     | +-------------------+ |
                 | | Traefik           | |     | | Traefik           | |
                 | | Service A         | |     | | Service B         | |
                 | +-------------------+ |     | +-------------------+ |
                 +-----------------------+     +-----------------------+

I basically use wildcard DNS (all pointing to server0) to expose services on each host. For example:

  • traefik.server0.mydomain
  • servicea.server0.mydomain
  • traefik.server1.mydomain
  • serviceb.server1.mydomain

My attempts:

server0(http,https), server1(http)

On server0:

  • http, https and traefik entrypoints
  • docker enabled
  • static rules for server1
    • http, https entrypoints
    • pass header
    • rule: HostRegexp:{subdomain:.*}.server1.mydomain
    • target: http://server1

On server1:

  • http, traefik entrypoints
  • docker enabled
# server0:/etc/traefik/traefik.toml
[entryPoints]
    [entryPoints.http]
        address = ":80"
        [entryPoints.http.redirect]
            entryPoint = "https"
    [entryPoints.https]
        address = ":443"
        [entryPoints.https.tls]
    [entryPoints.traefik]
        address=":8080"

[api]
[ping]
[file]
directory = "/etc/traefik/config.d"

[docker]
watch = true
exposedByDefault = false
network = "traefik"

[acme]
email = "foo@bar.com"
storage = "/data/acme.json"
entryPoint = "https"
onHostRule = true
    [acme.httpChallenge]
    entryPoint = "http"


# server0:/etc/traefik/config.d/server1.toml
[frontends]
    [frontends.server1]
        entryPoints = ["http", "https"]
        backend = "server1"
        passHostHeader = true
        [frontends.server1.routes]
            [frontends.server1.routes.main]
                rule = "HostRegexp:{subdomain:.*}.server1.mydomain"
[backends]
    [backends.server1]
        [backends.server1.servers]
            [backends.server1.servers.main]
                url = "http://server1.local"


# server1:/etc/traefik/traefik.toml
[entryPoints]
    [entryPoints.http]
        address = ":80"
    [entryPoints.traefik]
        address=":8080"

[api]
[ping]

[docker]
watch = true
exposedByDefault = false
network = "traefik"

Result:

  • traefik.server0.mydomain: OK, valid certificate (Let's Encrypt)
  • serviceA.server0.mydomain: OK, valid certificate (Let's Encrypt)
  • traefik.server1.mydomain: OK, invalid certificate (Traefik default cert)

server0(http,https), server1(http,https)

On server0:

  • http, https and traefik entrypoints
  • docker enabled
  • static rules for server1
    • http, https entrypoints
    • pass header
    • rule: HostRegexp:{subdomain:.*}.server1.mydomain
    • target: https://server1

On server1:

  • http,https,traefik entrypoints
  • docker enabled
# server0:/etc/traefik/traefik.toml
[entryPoints]
    [entryPoints.http]
        address = ":80"
        [entryPoints.http.redirect]
            entryPoint = "https"
    [entryPoints.https]
        address = ":443"
        [entryPoints.https.tls]
    [entryPoints.traefik]
        address=":8080"

[api]
[ping]
[file]
directory = "/etc/traefik/config.d"

[docker]
watch = true
exposedByDefault = false
network = "traefik"

[acme]
email = "foo@bar.com"
storage = "/data/acme.json"
entryPoint = "https"
onHostRule = true
    [acme.httpChallenge]
    entryPoint = "http"


# server0:/etc/traefik/config.d/server1.toml
[frontends]
    [frontends.server1]
        entryPoints = ["http", "https"]
        backend = "server1"
        passHostHeader = true
        [frontends.server1.routes]
            [frontends.server1.routes.main]
                rule = "HostRegexp:{subdomain:.*}.server1.mydomain"
[backends]
    [backends.server1]
        [backends.server1.servers]
            [backends.server1.servers.main]
                url = "https://server1.local"


# server1:/etc/traefik/traefik.toml
[entryPoints]
    [entryPoints.http]
        address = ":80"
    [entryPoints.https]
        address = ":443"
        [entryPoints.https.tls]
    [entryPoints.traefik]
        address=":8080"

[api]
[ping]

[docker]
watch = true
exposedByDefault = false
network = "traefik"

[acme]
email = "foo@bar.com"
storage = "/data/acme.json"
entryPoint = "https"
onHostRule = true
    [acme.httpChallenge]
    entryPoint = "http"

Result:

* `traefik.server0.mydomain`: OK, valid certificate (Let's Encrypt)
* `serviceA.server0.mydomain`: OK, valid certificate (Let's Encrypt)
* `traefik.server1.mydomain`: internal server error (no log), invalid certificate (Traefik default cert)
 


I don't know which options to use to have correct behavior ...
Logan Mzz
  • 101
  • 4

1 Answers1

0

Lets-encrypt won't let you verify internal domain because it can't see it/access it. So you need to validate it on public IP. But I'm not sure you'll be able to do exactly what you're asking, you may need to change your DNS a bit.

This article shall help you understand the general issue.

Geeky Masters
  • 729
  • 3
  • 8
  • It's not my issue, internal servers are publicly reachable through `server0` which act as a gateway. – Logan Mzz Jul 24 '20 at 14:09
  • ah okay I see, are you using dns validation or "well-know/acme-challenge"? – Geeky Masters Jul 24 '20 at 14:12
  • HTTP challenge as stated in shared Traefik config – Logan Mzz Jul 24 '20 at 14:14
  • The "http challenge" is not good approach when you're building "couldish" environment. If I understand properly on server1 the validation fails? Can you use/try DNS validation instead? It's simply less hassle than rely on files in some folder especially in your case IMHO. – Geeky Masters Jul 24 '20 at 14:19
  • Do you know modern reverse proxies ? Or simply Traefik ? – Logan Mzz Jul 24 '20 at 14:20
  • I'd say I do and seems you're hitting similar issue like [here](https://stackoverflow.com/questions/48408184/traefik-will-issue-certificate-instead-of-lets-encrypt), or maybe I misunderstood your question. – Geeky Masters Jul 24 '20 at 14:24