traefik DNS-01 + 内网 https

vim .env

ALIYUN_DNS_ACCESS_KEY=你的RAM用户AccessKeyID
ALIYUN_DNS_SECRET_KEY=你的RAM用户AccessKeySecret

yml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped

    command:
      - --api.dashboard=true

      # Providers
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.file.directory=/etc/traefik/dynamic
      - --providers.file.watch=true

      # EntryPoints
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443

      # HTTP 自动跳转 HTTPS
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true

      # Let's Encrypt + HTTP-01
      - --certificatesresolvers.letsencrypt-http01.acme.email=694666422@qq.com
      - --certificatesresolvers.letsencrypt-http01.acme.storage=/var/lib/traefik/acme/letsencrypt/http01.json
      - --certificatesresolvers.letsencrypt-http01.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt-http01.acme.httpchallenge.entrypoint=web

      # Let's Encrypt + DNS-01 + AliDNS
      - --certificatesresolvers.letsencrypt-dns01-alidns.acme.email=694666422@qq.com
      - --certificatesresolvers.letsencrypt-dns01-alidns.acme.storage=/var/lib/traefik/acme/letsencrypt/dns01-alidns.json
      - --certificatesresolvers.letsencrypt-dns01-alidns.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt-dns01-alidns.acme.dnschallenge.provider=alidns
      - --certificatesresolvers.letsencrypt-dns01-alidns.acme.dnschallenge.resolvers=223.5.5.5:53,1.1.1.1:53

      # Logs
      - --log.level=INFO
      - --accesslog=true
      - --accesslog.filepath=/var/log/traefik/access.log

    environment:
      ALICLOUD_ACCESS_KEY: ${ALIYUN_DNS_ACCESS_KEY:?ALIYUN_DNS_ACCESS_KEY is required}
      ALICLOUD_SECRET_KEY: ${ALIYUN_DNS_SECRET_KEY:?ALIYUN_DNS_SECRET_KEY is required}

    ports:
      - "80:80"
      - "443:443"

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./acme:/var/lib/traefik/acme
      - ./dynamic:/etc/traefik/dynamic:ro
      - ./logs:/var/log/traefik

    networks:
      - traefik-net

networks:
  traefik-net:
    external: true

mkdir -p acme/letsencrypt

touch acme/letsencrypt/http01.json
touch acme/letsencrypt/dns01-alidns.json

chmod 600 acme/letsencrypt/http01.json
chmod 600 acme/letsencrypt/dns01-alidns.json

使用示例

yml

# 能从公网通过 80 端口验证的项目
tls:
  certResolver: letsencrypt-http01

# Penpot 等纯内网项目
tls:
  certResolver: letsencrypt-dns01-alidns

yml

http:
  routers:
    penpot-http:
      rule: Host(`ui.lab.q123q.cc`)
      entryPoints:
        - web
      service: penpot

    penpot-https:
      rule: Host(`ui.lab.q123q.cc`)
      entryPoints:
        - websecure
      service: penpot
      tls:
        certResolver: letsencrypt-dns01-alidns

  services:
    penpot:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: http://192.168.10.50:9001

traefik DNS-01 + 内网 https ​

traefik DNS-01 + 内网 https