Default redirect isn't working

Traefik Traefik v2 (latest)
,
1

I'm using default redirection(below config) under command section.

command:
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --entrypoints.websecure.address=:443

But it is not working. when I type traefik.example.com/dashboard/ in brower then I'm excepting it to redirect to https://traefik.example.com/dashboard/.

config file

version: '3.8'

services:

  traefik:
    image: "traefik:v2.2.1"
    hostname: traefik
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
      placement:
        constraints:
          - node.hostname == mynode
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.api.rule=Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
        - "traefik.http.routers.api.service=api@internal"
        - "traefik.http.routers.api.middlewares=auth" #Auth is only setup on the router using the web entrypoint

        ## Middlewares
        - "traefik.http.middlewares.auth.basicauth.users=alpha:$$1$$SEjVHN0z$$Apa3.iHJAW2dbAi6OuwDe/"
        ### host header
        - "traefik.http.middlewares.hosthdr.headers.stsseconds=31536000"
        - "traefik.http.middlewares.hosthdr.headers.stsincludesubdomains=true"
        - "traefik.http.middlewares.hosthdr.headers.stspreload=true"

        # global redirect http to https
        #- "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
        #- "traefik.http.routers.http-catchall.entrypoints=web"
        #- "traefik.http.routers.http-catchall.middlewares=httpsalways"

        # middleware redirect http to https
        #- "traefik.http.middlewares.httpsalways.redirectscheme.scheme=https"
        #- "traefik.http.middlewares.httpsalways.redirectscheme.permanent=true"
        #- "traefik.http.middlewares.httpsalways.redirectscheme.port=443"

          #- "traefik.http.middlewares.httptohttps.redirectregex.regex=^https?://(?:www\.)?(.+)"
          #- "traefik.http.middlewares.httptohttps.redirectregex.replacement=https://$${1}"
          #- "traefik.http.middlewares.httptohttps.redirectregex.permanent=true"

        # enable https for api/dashboard
        - "traefik.http.routers.api.tls=true"
        - "traefik.http.routers.api.tls.certresolver=letsencrypt"
        - "traefik.http.routers.api.entrypoints=websecure"
        - "traefik.http.routers.api.tls.domains[0].main=traefik.example.com"
        # dummy port
        - "traefik.http.services.dummyservice.loadbalancer.server.port=1111" # In swarm mode, traefik requires a dummy Port

    command:
      - --api=true
      - --api.dashboard=true
      - --api.debug=true
      - --providers.docker=true
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --providers.docker.swarmMode=true
      - --providers.docker.exposedbydefault=false
      - --log.level=DEBUG
      - --accesslog=false
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --entrypoints.websecure.address=:443
      - --certificatesResolvers.letsencrypt.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory
        #- --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesResolvers.letsencrypt.acme.tlsChallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=myemail@gmail.com
      - --certificatesResolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
        #- --certificatesResolvers.letsencrypt.acme.httpChallenge.entryPoint=web

    ports:
      - target: 80
        published: 80
        mode: host

      - target: 443
        published: 443
        mode: host

    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "./letsencrypt:/letsencrypt"
#- "./basicauth:/basicauth:ro"
    networks:
      - proxy

networks:
  proxy:
    external: true

Please help.

2

Also, I tried this too by disabling the default redirect under command section but it is also not working.

config

labels:
        traefik.enable: "true"
        traefik.docker.network: proxy
        traefik.http.routers.api.rule: Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
        traefik.http.routers.api.service: api@internal
        traefik.http.routers.api.middlewares: auth #Auth is only setup on the router using the web entrypoint

        ## Middlewares
        traefik.http.middlewares.auth.basicauth.users: alpha:$$1$$SEjVHN0z$$Apa3.iHJAW2dbAi6OuwDe/

        ### host header
        traefik.http.middlewares.hosthdr.headers.stsseconds: 31536000
        traefik.http.middlewares.hosthdr.headers.stsincludesubdomains: "true"
        traefik.http.middlewares.hosthdr.headers.stspreload: "true"

        # global redirect http to https
        traefik.http.routers.http-catchall.rule: HostRegexp(`{host:(www\.)?.+}`)
        traefik.http.routers.http-catchall.entrypoints: web
        traefik.http.routers.http-catchall.middlewares: wwwtohttps

        # Global redirection: https (www.) to https
        traefik.http.routers.wwwsecure-catchall.rule: HostRegexp(`{host:(www\.).+}`)
        traefik.http.routers.wwwsecure-catchall.entrypoints: websecure
        traefik.http.routers.wwwsecure-catchall.tls: "true"
        traefik.http.routers.wwwsecure-catchall.middlewares: wwwtohttps

        # middleware: http(s)://(www.) to  https://
        traefik.http.middlewares.wwwtohttps.redirectregex.regex: ^https?://(?:www\.)?(.+)
        traefik.http.middlewares.wwwtohttps.redirectregex.replacement: https://$${1}
        traefik.http.middlewares.wwwtohttps.redirectregex.permanent: "true"

        # enable https for api/dashboard
        traefik.http.routers.api.tls: "true"
        traefik.http.routers.api.tls.certresolver: letsencrypt
        #traefik.http.routers.api.entrypoints: websecure
        traefik.http.routers.api.tls.domains[0].main: traefik.example.com

        # dummy port
        traefik.http.services.dummyservice.loadbalancer.server.port: 1111 # In swarm mode, traefik requires a dummy Port

    command:
      - --api=true
      - --api.dashboard=true
      - --api.debug=true
      - --providers.docker=true
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --providers.docker.swarmMode=true
      - --providers.docker.exposedbydefault=false
      - --log.level=DEBUG
      - --accesslog=false
      - --entrypoints.web.address=:80
        #- --entrypoints.web.http.redirections.entrypoint.to=websecure
        #- --entrypoints.web.http.redirections.entrypoint.scheme=https
        #- --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --entrypoints.websecure.address=:443
      - --certificatesResolvers.letsencrypt.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory
        #- --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesResolvers.letsencrypt.acme.tlsChallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=myemail@gmail.com
      - --certificatesResolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
        #- --certificatesResolvers.letsencrypt.acme.httpChallenge.entryPoint=web
3

@ldez can you please help?

4

tried using dynamic file also.

#############
#### ROUTER
#############

[http.routers]
    ### Traefik Dashboard
    [http.routers.api]
        rule = "HostRegexp(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
        entryPoints = ["websecure"]  # <-- changed to `websecure` for https else moved it back to `web`
        middlewares = ["auth"]
        service = "api@internal"

        # will route TLS requests (and ignore non tls requests)
        [http.routers.api.tls]
            certResolver = "letsencrypt"
            # https://docs.traefik.io/routing/routers/#domains
            [[http.routers.api.tls.domains]]
            main = "traefik.example.com"

    # redirecting http to https for dashboard
    [http.routers.api-http]
        entryPoints = ["web"]
        rule = "HostRegexp(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
        middlewares = ["auth", "redirect-to-https"]
        service = "api@internal"

#################
#### MIDDLEWARES
#################
[http.middlewares]
    [http.middlewares.auth.basicAuth]
        users = ["alpha:$1$SEjVHN0z$Apa3.iHJAW2dbAi6OuwDe/"]

    [http.middlewares.redirect-to-https.redirectScheme]
        scheme = "https"
        port = "443"
        permanent = true

traefik.yml file

version: '3.8'

services:

  traefik:
    image: "traefik:v2.1"
    hostname: traefik
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
      placement:
        constraints:
          - node.hostname == node1
      labels:
        traefik.enable: "true"
        traefik.docker.network: proxy
        # dummy port
        traefik.http.services.dummyservice.loadbalancer.server.port: 1111 # In swarm mode, traefik requires a dummy Port

    command:
      - --api=true
      - --api.dashboard=true
      - --api.debug=true
      - --providers.file.filename=/etc/traefik/traefik-dynamic.toml # Using file for reading the config
      - --providers.file.watch=true
      - --providers.docker=true
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --providers.docker.swarmMode=true
      - --providers.docker.exposedbydefault=false
      - --log.level=DEBUG
      - --accesslog=false
      - --entrypoints.web.address=:80
        #- --entrypoints.web.http.redirections.entrypoint.to=websecure
        # - --entrypoints.web.http.redirections.entrypoint.scheme=https
        # - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --entrypoints.websecure.address=:443
      - --certificatesResolvers.letsencrypt.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory
      - --certificatesResolvers.letsencrypt.acme.tlsChallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=myemail@gmail.com
      - --certificatesResolvers.letsencrypt.acme.storage=/letsencrypt/acme.json

    ports:
      - target: 80
        published: 80
        mode: host

      - target: 443
        published: 443
        mode: host

    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "./letsencrypt:/letsencrypt"
      - "./traefik-dynamic.toml:/etc/traefik/traefik-dynamic.toml:ro"
#- "./basicauth:/basicauth:ro"
    networks:
      - proxy

networks:
  proxy:
    external: true

This is not working.

6

I'm also using Grafana and below is the config under lables.

labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.grafana.rule=Host(`grafana.example.com`)"
        - "traefik.http.routers.grafana.entryPoints=websecure"
        - "traefik.http.routers.grafana.service=grafana-service"
        # global redirect http to https
        - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
        - "traefik.http.routers.http-catchall.entrypoints=web"
        - "traefik.http.routers.http-catchall.middlewares=httpsalways"
        # middleware redirect http to https
        - "traefik.http.middlewares.httpsalways.redirectscheme.scheme=https"
        - "traefik.http.middlewares.httpsalways.redirectscheme.permanent=true"
        - "traefik.http.middlewares.httpsalways.redirectscheme.port=443"
        #
        - "traefik.http.routers.grafana.tls=true"
        - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
        - "traefik.http.routers.grafana.tls.domains[0].main=grafana.example.com"
        - "traefik.http.services.grafana-service.loadbalancer.server.port=3000"

Is anything wrong in this config? because grafana.example.com ins't redirecting to https://grafana.example.com but same config works for traefik.example.com to https://traefik.example.com

7

Hi @metadata

This is my simple swarm config. No certresolver or auth middleware is enabled. But it is a starting point to layer these items in.

Compose for stack 
version: "3.8"

services:
  traefik:
    image: "traefik:v2.2"
    command:
    - --entrypoints.web.address=:80
    - --entrypoints.web.http.redirections.entryPoint.to=websecure
    - --entrypoints.web.http.redirections.entryPoint.scheme=https
    - --entrypoints.web.http.redirections.entrypoint.permanent=true
    - --entrypoints.websecure.address=:443
    - --entrypoints.websecure.http.tls=true
    - --providers.docker=true
    - --providers.docker.swarmMode=true
    - --providers.docker.exposedbydefault=false
    - --api
    deploy:
      placement:
        constraints:
        - node.role == manager
      labels:
        traefik.enable: "true"
        # traefik.http.routers.api.rule: Host(`foo.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
        traefik.http.routers.api.rule: PathPrefix(`/api`) || PathPrefix(`/dashboard`)
        traefik.http.routers.api.service: api@internal
        traefik.http.services.dummy.loadBalancer.server.port: 65535
        traefik.http.routers.api.entrypoints: websecure
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
Stack Deploy 
 $ docker stack deploy -c simple.swarm.yaml tk
Creating network tk_default
Creating service tk_traefik
http redirect demo 
$ curl -ikL http://localhost/dashboard/
HTTP/1.1 301 Moved Permanently
Location: https://localhost/dashboard/
Date: Fri, 29 May 2020 11:51:33 GMT
Content-Length: 17
Content-Type: text/plain; charset=utf-8

HTTP/2 200 
accept-ranges: bytes
content-type: text/html; charset=utf-8
last-modified: Wed, 29 Apr 2020 18:00:36 GMT
content-length: 2708
date: Fri, 29 May 2020 11:51:33 GMT

<!DOCTYPE html><html><head><title>Traefik</title>...
8

@cakiwi thanks . After using this static config I can see that its working using cURL

curl -ikL http://grafana.example.in/
HTTP/1.1 301 Moved Permanently
Location: https://grafana.example.in/
Date: Fri, 29 May 2020 12:19:38 GMT
Content-Length: 17
Content-Type: text/plain; charset=utf-8

HTTP/2 302
content-type: text/html; charset=utf-8
date: Fri, 29 May 2020 12:19:38 GMT
location: /login
set-cookie: grafana_sess=221ef5a23382af4c; Path=/; HttpOnly
set-cookie: redirect_to=%252F; Path=/; HttpOnly
content-length: 29

HTTP/2 200
content-type: text/html; charset=UTF-8
date: Fri, 29 May 2020 12:19:38 GMT

But still not working in browser? I have tried it on chrome, brave, mozilla, edge.
do I need to add any header?

config grafana

labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.grafana.rule=Host(`grafana.example.in`)"
        - "traefik.http.routers.grafana.entryPoints=websecure"
        - "traefik.http.routers.grafana.service=grafana-service"
        - "traefik.http.routers.grafana.tls=true"
        - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
        - "traefik.http.routers.grafana.tls.domains[0].main=grafana.example.in"
        - "traefik.http.services.grafana-service.loadbalancer.server.port=3000"
9

That it works with curl demonstrates it is technically correct. What error do you get on the browsers ?

Is it possible that there was an HSTS header set for this domain in the past, or has made it into the browsers' compiled in list? You can check that in chrome pretty easily.

Aside from that I would enable Traefik Access log and see what requests are coming in and how they are being handled.

10

@cakiwi it's working now. port 80 wasn't opened for public IP in firewall. I tested it by accessing the service from my local env using cURL(not accessible becuase of port issue). Earlier I was sshed to VM and then running the cURL hence it was working.

Thanks a lot for the help :slight_smile: