traefik配置通配符证书

作者
182 次阅读

本文最后更新于 2026年5月11日。

权限太高被traefik禁止

time="2023-09-11T00:55:46-05:00" level=error msg="The ACME resolver \"myresolver\" is skipped from the resolvers list because: unable to get ACME account: permissions 644 for acme-dns0.json are too open, please use 600"

改成600权限

chmod 600 /var/lib/docker/volumes/dc/data/acme-dns0.json

看文档一定看对应的版本

https://doc.traefik.io/traefik/v2.8/https/acme/
https://doc.traefik.io/traefik/v2.8/https/acme/#dnschallenge

https://doc.traefik.io/traefik/https/acme/#providers

还不会Traefik？看这篇文章就够了！(二）

https://developer.aliyun.com/article/943362

一文搞定快速使用 Docker Compose 玩转 Traefik v2
https://cloud.tencent.com/developer/article/1829161

一文搞懂 Traefik2.1 的使用

https://zhuanlan.zhihu.com/p/111267604

ALIBABA CLOUD DNS

https://go-acme.github.io/lego/dns/alidns/

lego+systemctl实现SSL泛解析证书注册并自动更新_小满1221…

终于配置通配符成功

dynamic.yml

“`

Dynamic configuration

http:
middlewares:
nofloc:
headers:
customResponseHeaders:
Permissions-Policy: ‘interest-cohort=()’
secureHeaders:
headers:
sslRedirect: true
forceSTSHeader: true
stsIncludeSubdomains: true
stsPreload: true
stsSeconds: 31536000

# UserName : admin
# Password : qwer1234
user-auth:
  basicAuth:
    # users 选项是认证用户的列表
    # 使用 echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g
    # 来创建 user:password 键值对
    users:
      - 'admin:$apr1$tm53ra6x$FntXd6jcvxYM/YH0P2hcc1'

routers:
taefik:
service: api@internal
entrypoints: websecure
rule: Host(index1.weiyoun.com)
tls:
certResolver: myresolver
domains:
– main: “weiyoun.com”
– sans:
– “*.weiyoun.com”
# tls:
# certresolver: lets-encr 

ittools:
  service: ittools
  entrypoints: websecure
  rule: Host(`ittools.weiyoun.com`)
  tls:
    certResolver: myresolver

services:
ittools:
loadBalancer:
servers:
– url: http://ittools:80

tls:
options:
default:
cipherSuites:
– TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
– TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
– TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
– TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
– TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
– TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
minVersion: VersionTLS12

“`

traefik.yml

“`
api:
dashboard: true
debug: true

entryPoints:
web:
address: :80
http:
redirections:
entryPoint:
to: websecure

websecure:
address: :443
# http:
# middlewares:
# – secureHeaders@file
# – nofloc@file
# – nonwww-www@file
# tls:
# certResolver: lets-encr

# mariadb:
# address: :3307

pilot:

# dashboard: false

dashboard: true

providers:
docker:
endpoint: ‘unix:///var/run/docker.sock’
exposedByDefault: false
file:
filename: /configurations/dynamic.yml # 动态配置文件位置

certificatesResolvers:
lets-encr:
acme:
#caServer: https://acme-staging-v02.api.letsencrypt.org/directory
storage: acme.json
email: gxmhm@outlook.com
httpChallenge:
entryPoint: web

myresolver:
acme:
storage: acme-dns0.json
email: gxmhm@outlook.com
# …
dnsChallenge:
provider: alidns
delayBeforeCheck: 0

工作日志

log:
filePath: gateway/log/traefik.log

访问日志

accessLog:
filePath: gateway/log/access.log
# 保留在内存中的日志行数
bufferingSize: 100
fields:
names:
# 设置本地时区,不然默认是0时区时间输出
StartLocal: keep
StartUTC: drop

“`

基于dns通配符证书的traefik设置

traefik-docker-compose.yml

“`
version: ‘3.7’

services:
traefik:
image: traefik:v2.8
container_name: traefik
restart: always
environment:
# 用于dns获取dns通配符域名
ALICLOUD_ACCESS_KEY: LTAI5tPHuFhzGANAoqeZkRqn
ALICLOUD_SECRET_KEY: NSu0RX9I0e2pZmOLXXJl5SmFbT7y9g
# dns:
# – 1.1.1.1
# – 1.0.0.1
security_opt:
– no-new-privileges:true
ports:
– 80:80
– 443:443
– 3307:3307 # 230726增加了mariadb的tcp代理，之前这里没有开启端口导致一直有错误
volumes:
# 如果宿主机是标准 linux 系统，可以设置一下localtime
– /etc/localtime:/etc/localtime:ro
– /var/run/docker.sock:/var/run/docker.sock:ro
– ./data/traefik.yml:/traefik.yml:ro # 映射静态配置文件
– ./data/acme-dns0.json:/acme-dns0.json # 映射证书文件，SSL 证书申请成功后，就会存在这个文件中
– ./data/acme.json:/acme.json # 映射证书文件，SSL 证书申请成功后，就会存在这个文件中
– ./data/configurations:/configurations # 映射动态配置文件
networks:
– traefik
labels:
# 下面这些标签，可以帮助 traefik 正确处理该服务
– ‘traefik.enable=true’
– ‘traefik.docker.network=traefik’ # 指定 docker network
# # 指定服务入口为 websecure，websecure 会在静态配置文件traefik.yml中定义
# – ‘traefik.http.routers.traefik-secure.entrypoints=websecure’
# # 定义访问域名，需要做 DNS 解析
# # – ‘traefik.http.routers.traefik-secure.rule=Host(traefik.yourdomain.com)’
# – ‘traefik.http.routers.traefik-secure.rule=Host(index1.weiyoun.com)’
# – ‘traefik.http.routers.traefik-secure.middlewares=user-auth@file’
# – ‘traefik.http.routers.traefik-secure.service=api@internal’
# # – ‘traefik.http.routers.traefik-secure.tls.certresolver=lets-encr’ # i add no use

networks:
traefik:
external: true

“`