using HTTP2 with dokploy

[ticapix]

Hello,

I'm trying to get HTTP2 (and later an HTTP3) services deployed with dokploy.

Below is the smallest setup I could make to reproduce my setup.

1. one Raw docker compose configuration

services:
  test:
    image: surma/simplehttp2server
    expose:
      - 5000

2. create a random domain *.traefik.me without HTTPS terminaison, forwarding to port 5000.

3. add an extra label in the Raw docker compose based on the newly generated name

    labels:
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadbalancer.server.scheme=https

The generated docker compose looks like that Preview Compose:

services:
  test:
    image: surma/simplehttp2server
    expose:
      - 5000
    labels:
      - traefik.docker.network=dokploy-network
      - traefik.http.routers.monitoring-http2test-namyib-12-web.rule=Host(`monitoring-http2test-namyib-c843b3-51-255-22-26.traefik.me`)
      - traefik.http.routers.monitoring-http2test-namyib-12-web.entrypoints=web
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadbalancer.server.port=5000
      - traefik.http.routers.monitoring-http2test-namyib-12-web.service=monitoring-http2test-namyib-12-web
      - traefik.enable=true
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadbalancer.server.scheme=https
    networks:
      - dokploy-network
networks:
  dokploy-network:
    external: true

And if I browse to http://monitoring-http2test-namyib-c843b3-51-255-22-26.traefik.me/, I'm getting an Internal Server Error with the following message in the traefik logs:

2025-11-17T21:49:06Z ERR 500 Internal Server Error error="tls: failed to verify certificate: x509: cannot validate certificate for 10.0.1.58 because it doesn't contain any IP SANs"

And it makes sense because surma/simplehttp2server uses self-signed certificate.

How to tell traefik to skip certificate verification ?

Traefik docs says to add a label to configure serversTransport

4. Add an extra label in the Raw docker compose base

    labels:
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadbalancer.server.scheme=https
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadBalancer.serversTransport=mytransport

Now, traefik says it can't find mytransport

2025-11-17T22:03:07Z ERR error="error building proxy for server URL https://10.0.1.59:5000/: getting RoundTripper: servers transport not found mytransport@docker" entryPointName=web routerName=monitoring-http2test-namyib-12-web@docker

5. I tried to declare mytransport via labels but I'm getting the same previous error

    labels:
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadbalancer.server.scheme=https
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadBalancer.serversTransport=mytransport
      - traefik.http.serversTransports.mytransport.insecureSkipVerify=true

Any idea ?

[ticapix]

adding mytransport to /etc/dokploy/traefik/dynamic/dokploy.yml seems ineffective and give the same error of servers transport not found mytransport@docker

http:
# default content goes here
  serversTransports:
    mytransport:
      insecureSkipVerify: true

Adding a suffix @file on my transport label doesn't change the error. Reloading traefik doesn't either.

Edit: based on traefik/traefik#8884 (comment), I need to declare the transport in a file and change my labels to

    labels:
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadbalancer.server.scheme=https
      - traefik.http.services.monitoring-http2test-namyib-12-web.loadBalancer.serversTransport=mytransport@file

How that can be done with dokploy ?

[ticapix]

Found it.

I have to manually edit /etc/dokploy/traefik/dynamic/middlewares.yml on the server where the service is running. Not the control plane.

http:
# default content goes here
  serversTransports:
    mytransport:
      insecureSkipVerify: true