Cannot Access Traefik Dashboard Over HTTPS

[gordho]

Thanks for all of the time and effort you have put in to making these secure images. You are a true value to the community!

I am able to access the dashboard through https when I use the official traefik image but when I use your image it does not work with my existing config. I am able to access the dashboard via 8080. Do you see anything with this config that could cause this?

  traefik:
    image: 11notes/traefik:3.5
    container_name: traefik
    command:
      - --log.level=INFO
      - --api.dashboard=true
      - --api.insecure=true # Set true to allow access to dashboard on http://localhost:8080
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.endpoint=tcp://socket-proxy:2375
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.myresolver.acme.dnschallenge=true
      - --certificatesresolvers.myresolver.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.myresolver.acme.email=${ACME_EMAIL}
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    depends_on:
      - socket-proxy
    env_file:
      - .env
    environment:
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cloudflare_api_token
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik_https.rule=Host(`traefik.${DOMAIN}`)
      - traefik.http.routers.traefik_https.entrypoints=websecure
      - traefik.http.routers.traefik_https.tls=true
      - traefik.http.routers.traefik_https.tls.certResolver=myresolver
      - traefik.http.routers.traefik_https.service=api@internal
      # Gets the root and wildcard certs, wildcard will be used by all services
      - traefik.http.routers.traefik_https.tls.domains[0].main=${DOMAIN}
      - traefik.http.routers.traefik_https.tls.domains[0].sans=*.${DOMAIN}
    networks:
      - standard
    ports:
      - 80:80
      - 443:443
      - 8080:8080 # Insecure access to traefik dashboard
    restart: unless-stopped
    secrets:
      - cloudflare_api_token
    sysctls:
      # allow rootless container to access ports < 1024
      net.ipv4.ip_unprivileged_port_start: 80
    user: 1000:1000
    volumes:
      - ${DATA_ROOT_DIR}/traefik/letsencrypt:/letsencrypt

[11notes]

Do you see anything with this config that could cause this?

No, not directly, but I see this:

- --api.insecure=true # Set true to allow access to dashboard on http://localhost:8080

With this you are exposing your interface without SSL, I do not recommend doing that. Always use SSL, also you have no authentication for your interface. You also do not need to set user, it's by default 1000:1000. I think it would be easier to take my config and simply remove the parts you don't need (like error middleware) and add your Cloudflare settings. Storing your certificates in a bind mount is also not recommended, use named volumes.

Thanks for all of the time and effort you have put in to making these secure images. You are a true value to the community!

Thank you very much ❤️