AdGuard behind Traefik | How to use DNS-over-HTTPS?

[der-domi]

Hi! I'm figuring same issues as #4656 - just with using Traefik as proxy.

Current status: DNS and DNS-over-TLS are working well.
Issue to be solved: How do I configure Traefik (and AdGuard), so that DNS-over-HTTPS does also work?

My AdGuardHome.yaml looks

bind_host: 0.0.0.0
bind_port: 80
users:
  - name: [...]
auth_attempts: 5
block_auth_min: 15
http_proxy: ""
language: ""
theme: auto
debug_pprof: false
web_session_ttl: 720
dns:
  bind_hosts:
    - 0.0.0.0
  port: 53
  [...]
tls:
  enabled: true
  server_name: dns.example.com
  force_https: false
  port_https: 443
  port_dns_over_tls: 853
  port_dns_over_quic: 853
  port_dnscrypt: 0
  dnscrypt_config_file: ""
  allow_unencrypted_doh: true
  certificate_chain: ""
  private_key: ""
  certificate_path: /opt/adguardhome/ssl/dns.example.com.crt
  private_key_path: /opt/adguardhome/ssl/dns.example.com.key
  strict_sni_check: false
[...]

My docker-compose.yml looks

version: '3.7'
services:
  adguard:
    image: adguard/adguardhome
    container_name: adguard
    restart: unless-stopped
    ports:
      - "53:53/tcp" #DNS
      - "53:53/udp" #DNS
      - "853:853/tcp" #DNS over TLS
    volumes:
      - "${DATA_DIRECTORY}/adguard/work:/opt/adguardhome/work:rw"
      - "${DATA_DIRECTORY}/adguard/conf:/opt/adguardhome/conf:rw"
      - "${DATA_DIRECTORY}/adguard/ssl:/opt/adguardhome/ssl:ro"
    labels:
      - "traefik.enable=true"
      # DNS-over-HTTPS
      - "traefik.http.routers.adguard-doh.rule=Host(`dns.example.com`)"
      - "traefik.http.routers.adguard-doh.entrypoints=websecure"
      - "traefik.http.routers.adguard-doh.tls=true"
      - "traefik.http.routers.adguard-doh.tls.certResolver=letsencrypt"
      - "traefik.http.routers.adguard-doh.middlewares=hsts@file"
      - "traefik.http.routers.adguard-doh.service=adguard-doh-svc"
      - "traefik.http.services.adguard-doh-svc.loadbalancer.server.port=443"
    networks:
      - reverse-proxy
networks:
  reverse-proxy:
    external: true

I've tried several things. E.g. adding following

      - traefik.http.middlewares.https_redirect.redirectscheme.permanent=true

But all I get is Client sent an HTTP request to an HTTPS server. or Internal Server Error with following label

      - "traefik.http.services.adguard-doh-svc.loadbalancer.server.scheme=https"

[der-domi]

With docker logs traefik I get following entry with each access.

2023/02/06 21:22:44 reverseproxy.go:505: httputil: ReverseProxy read error during body copy: read tcp 172.19.0.2:35550->172.19.0.4:443: read: connection reset by peer

Currently I'm not sure what the root cause can be.

On a test server I've only started Traefik and AdGuard and removed everything releated to IPv6 what I have added recently to my environment.

When I started Traefik the fist time I got following error.

Error response from daemon: AppArmor enabled on system but the docker-default profile could not be loaded: running `apparmor_parser apparmor_parser --version` failed with output:
error: exec: "apparmor_parser": executable file not found in $PATH

So I've installed apt-get install apparmor. But it is inactive. systemctl status apparmor:

● apparmor.service - Load AppArmor profiles
     Loaded: loaded (/lib/systemd/system/apparmor.service; disabled; vendor preset: enabled)
     Active: inactive (dead)
       Docs: man:apparmor(7)
             https://gitlab.com/apparmor/apparmor/wikis/home/

[der-domi]

BTW: I've already tried to get rid from the HTTP to HTTPS mapping by using port 80 for HTTPS

AdGuardHome.yaml:

tls:
  enabled: true
  server_name: dns.example.com
  force_https: false
  port_https: 80
  port_dns_over_tls: 853
  port_dns_over_quic: 853
  port_dnscrypt: 0
  dnscrypt_config_file: ""
  allow_unencrypted_doh: true
  certificate_chain: ""
  private_key: ""
  certificate_path: /opt/adguardhome/ssl/dns.example.com.crt
  private_key_path: /opt/adguardhome/ssl/dns.exampl.com.key
  strict_sni_check: false

docker-compose.yml:

      - "traefik.http.services.adguard-doh-svc.loadbalancer.server.port=80"

This results also in Client sent an HTTP request to an HTTPS server. with docker logs traefik

2023/02/08 12:13:23 reverseproxy.go:505: httputil: ReverseProxy read error during body copy: read tcp 172.18.0.7:43788->172.18.0.6:80: read: connection reset by peer

Question is: How are you using DNS-over-HTTPS using Traefik as a reverse-proxy?

[saftl]

I have the Same issue, Any solution?

[ReFleXzZ]

Even when it's almost a year later, I face the exact same problem. I can open the AdGuard-Home Dashboard, but I cannot access the DNS over HTTPS server. My tls-settings are the exact same. There is just a problem with the tls-termination. Some thing regarding Traefik and AdGuard-Home. When I use https://agh:80 instead of http://agh:80 as the loadbalancer url in Traefik, then I get the "Internal Server Error" alongside this log entry:
[error] http: TLS handshake error from 10.19.0.2:54064: remote error: tls: bad certificate server=https ( 10.19.0.2 here is the Traefik revers proxy). So either way it doesn't work. This problem only started after a specific update, because before I never had any problems with TLS termination from Traefik and AdGuard-Home. It's completely annoying.

So I would be very open for any help and suggestions! I don't want to change my reverse Proxy just because AGH is not able to read the requests from Traefik or to terminate / start tls properly. And since I don't think it would be much useful for me, to use local certificates just for the communication between Traefik and a service likt AGH, since both the reverse proxy and AdGuard-Home are on the same host on Docker. This would complicate things quite too much for this usecase.