Https redirection not working when providers.docker.exposedbydefault=false

Traefik Traefik v2 (latest)
1

Hi all! I'm using the following docker-compose file:

version: "3.3"
services:
  traefik:
    image: traefik
    command:
      - "--entryPoints.http.address=:80"
      - "--entryPoints.https.address=:443"
      - "--providers.docker"
      - "--providers.file.filename=dynamic.toml"
      - "--providers.file.watch=true"
      - "--providers.docker.exposedbydefault=false"
    ports:
      - 80:80
      - 443:443
    labels:
      - "traefik.http.routers.redirect.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.redirect.entrypoints=http"
      - "traefik.http.routers.redirect.middlewares=redirect"
      - "traefik.http.middlewares.redirect.redirectscheme.scheme=https"
    volumes:
      - $PWD/dynamic.toml:/dynamic.toml
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: always

When I include --providers.docker.exposedbydefault=false in commands, the https redirection does not work (even when traefik.enable=true is included in my container's labels). When I set providers.docker.exposedbydefault to true, redirection works as expected.

How can I make it so I can specify --providers.docker.exposedbydefault=false and redirection works. I want to be able to control which containers are enabled in traefik using traefik.enable=true.

Thanks!

2

Hello,

--providers.docker.exposedbydefault=false flags implies that you have to set the label traefik.enable=true on the container.

The following example works as expected:

version: "3.3"
services:
  traefik:
    image: traefik:v2.1.1
    command:
      - "--entrypoints.http.address=:80"
      - "--entrypoints.https.address=:443"
      - "--providers.docker"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.file.directory=/dyn/"
      - "--providers.file.watch=true"
    ports:
      - 80:80
      - 443:443
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.redirect.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.redirect.entrypoints=http"
      - "traefik.http.routers.redirect.middlewares=redirect"
      - "traefik.http.middlewares.redirect.redirectscheme.scheme=https"
    volumes:
      - $PWD/dyn/:/dyn/
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: always

https://docs.traefik.io/v2.1/providers/docker/#exposedbydefault

I recommend to mount and use directory instead of a file name for the file provider data.
https://docs.traefik.io/v2.1/providers/file/#provider-configuration

I recommend to use an explicit version for traefik instead of latest: v2.1.1 (or at least v2.1)

3

Thanks for the reply! You are right. Setting "traefik.enable=true" on the traefik container fixed the issue. What is the reason for needing the "traefik.enable=true" label on the traefik container? I know it's needed for sure on the application containers but didn't know the traefik container needed it as well. I played with it a bit more and noticed that if I put the redirect configuration in the dynamic file, then the "traefik.enable=true" label is not needed for https redirection to work. This is the config I tried in the dynamic file:

[http.routers]
  [http.routers.redirect]
    rule = "HostRegexp(`{host:.+}`)"
    entryPoints = ["http"]
    middlewares = ["redirect"]
    service = "noop"

[http.middlewares]
  [http.middlewares.redirect.redirectScheme]
    scheme = "https"

[http.services]
  [http.services.noop.loadBalancer]
    [[http.services.noop.loadBalancer.servers]]
      url = ""
4

"traefik.enable=true" is a label that instructs traefik to process other docker labels and create configuration from them (or default one if no other labels) accordingly. This is a provider specific concept, namely docker provider. You do not need the label if you do not use --providers.docker.exposedbydefault=false because in this case by default the labels are processed and dynamic configuration is created for all containers.

In your last example you are using file provider, not docker provider, so naturally "traefik.enable=true" is irrelevant in this case.

5

Great! Thanks for the explanation!