Traefik HTTPS use hostname instead to IP - docker

Question

I have a NiFi instance running on Docker, we use a Reverse-Proxy**(Traefik)** to send the requests to the NiFi docker instance.
When my NiFi instance is running on HTTP I am able to reach the NiFi UI from the internet. Considering we wanted to have login option, I was working to setup HTTPS as login auth is not possible on HTTP NiFi instance.The setup is all working when I apply a global level SSL verify skip in the Reverse-Proxy level using insecureSkipVerify, but I would not want to do that and when I am on the normal setup to verify the certificates that are generated by NiFi automatically which is a Self-Signed cert it fails with the following error
{"level":"debug","msg":"'500 Internal Server Error' caused by: x509: cannot validate certificate for 10.0.2.60 because it doesn't contain any IP SANs","time":"2022-10-21T10:29:18Z"}
Also checked the /etc/hosts file
root#mynifi:/opt/nifi/nifi-current/conf# cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.0.2.60 mynifi
The issue is when Traefik is acting as the load-balancer it seems to be trying to access the service using IP address instead of Hostname
{
"ForwardURL": {
"Scheme": "https",
"Opaque": "",
"User": null,
"Host": "10.0.2.60:8443",
"Path": "",
"RawPath": "",
"OmitHost": false,
"ForceQuery": false,
"RawQuery": "",
"Fragment": "",
"RawFragment": ""
},
"Request": "{\"Method\":\"GET\",\"URL\":{\"Scheme\":\"\",\"Opaque\":\"\",\"User\":null,\"Host\":\"\",\"Path\":\"/nifi/\",\"RawPath\":\"\",\"OmitHost\":false,\"ForceQuery\":false,\"RawQuery\":\"\",\"Fragment\":\"\",\"RawFragment\":\"\"},\"Proto\":\"HTTP/2.0\",\"ProtoMajor\":2,\"ProtoMinor\":0,\"Header\":{\"Accept\":[\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\"],\"Accept-Encoding\":[\"gzip, deflate, br\"],\"Accept-Language\":[\"en-US,en;q=0.5\"],\"Cache-Control\":[\"max-age=0\"],\"Cookie\":[\"__Secure-Request-Token=00c9e232-fb30-44e0-a41e-fc0b5ba6b9b5\"],\"Te\":[\"trailers\"],\"Upgrade-Insecure-Requests\":[\"1\"],\"User-Agent\":[\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0\"],\"X-Forwarded-Host\":[\"example.domain.com\"],\"X-Forwarded-Port\":[\"443\"],\"X-Forwarded-Proto\":[\"https\"],\"X-Forwarded-Server\":[\"d9c0b0e2855e\"],\"X-Proxyhost\":[\"example.domain.com\"],\"X-Proxyport\":[\"443\"],\"X-Proxyscheme\":[\"https\"],\"X-Real-Ip\":[\"143.155.67.98\"]},\"ContentLength\":0,\"TransferEncoding\":null,\"Host\":\"example.domain.com\",\"Form\":null,\"PostForm\":null,\"MultipartForm\":null,\"Trailer\":null,\"RemoteAddr\":\"192.168.52.48:51731\",\"RequestURI\":\"/nifi/\",\"TLS\":null}",
"level": "debug",
"msg": "vulcand/oxy/roundrobin/rr: Forwarding this request to URL",
"time": "2022-10-21T15:23:35Z"
}
Is there an option to have the hostname defined within the docker-compose file to be used instead of the IP as my service is accessible using the hostname as I was able to confirm that via the curl command on the docker container.
As the docker containers IP keeps changing each time its redeployed I would really be difficult to generate a certificate with IP of the container.
I tried to use the below labels but I am not sure if its the right one to use in this case
- "traefik.http.middlewares.nifi-redirect.redirectregex.permanent=true"
- "traefik.http.middlewares.nifi-redirect.redirectregex.regex=^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?):8443"
- "traefik.http.middlewares.nifi-redirect.redirectregex.replacement=mynifi:8443"
I wanted to know if I can someway instruct Traefik to make the request using the hostname defined instead of the IP
For example
Traefik calls my service using the IP of the container i.e https://10.0.2.90:8443/nifi
I would prefer to use the hostname and Traefik reaches the container using https://mynifi:8443/nifi
Please do let me know if any additional details are needed
Docker-Compose.yml file
version: "3.7"
services:
nifi:
user: root
hostname: mynifi
# container_name: nifi_container_persistent
image: apache/nifi:latest
restart: on-failure
# command:
# - "--serverstransport.insecureskipverify=true"
environment:
- NIFI_WEB_HTTPS_PORT=8443
- NIFI_WEB_HTTPS_HOST=0.0.0.0
# - NIFI_REMOTE_INPUT_HOST=$DOCKER_HOST_URL
- NIFI_WEB_PROXY_HOST=$DOCKER_HOST_URL:443
# - NIFI_WEB_PROXY_CONTEXT_PATH=/nifi,/nifi-docs,/nifi-api,/
- NIFI_WEB_PROXY_CONTEXT_PATH=/
- SINGLE_USER_CREDENTIALS_USERNAME=admin
- SINGLE_USER_CREDENTIALS_PASSWORD=ctsBtRBKHRAx69EqUghvvgEvjnaLjFEB
- NIFI_SECURITY.AUTORELOAD.ENABLED=true
# - NIFI_REMOTE_INPUT_SECURE=false
# - NIFI_WEB_REQUEST_IP_WHITELIST=$DOCKER_HOST_URL
# - NIFI_CLUSTER_NODE_PROTOCOL_PORT=8082
# - NIFI_ZK_CONNECT_STRING=myzookeeper:2181
# - NIFI_ELECTION_MAX_WAIT=30 sec
# - NIFI_SENSITIVE_PROPS_KEY='12345678901234567890A'
# - DOCKER_HEALTHCHECK_TEST=curl $DOCKER_HOST_URL/nifi/
# healthcheck:
# test: "${DOCKER_HEALTHCHECK_TEST:-curl $DOCKER_HOST_URL/nifi/}"
# interval: "60s"
# timeout: "3s"
# start_period: "5s"
# retries: 5
volumes:
- nifi_database_repository:/opt/nifi/nifi-current/database_repository
- nifi_flowfile_repository:/opt/nifi/nifi-current/flowfile_repository
- nifi_content_repository:/opt/nifi/nifi-current/content_repository
- nifi_provenance_repository:/opt/nifi/nifi-current/provenance_repository
- nifi_state:/opt/nifi/nifi-current/state
- nifi_logs:/opt/nifi/nifi-current/logs
- nifi_conf:/opt/nifi/nifi-current/conf
networks:
traefik_webgateway:
deploy:
labels:
# traefik
- traefik.enable=true
# service
- traefik.http.services.nifi-flow.loadbalancer.server.port=8443
- traefik.http.services.nifi-flow.loadbalancer.server.scheme=https
# - "traefik.http.services.nifi-flow.loadbalancer.serverstransports.insecureskipverify=true"
# middlewares
# - "traefik.http.middlewares.nifi-redirect.redirectscheme.scheme=https"
- "traefik.http.middlewares.nifi-headers.headers.customRequestHeaders.X-ProxyScheme=https"
- "traefik.http.middlewares.nifi-headers.headers.customRequestHeaders.X-ProxyHost=$DOCKER_HOST_URL"
- "traefik.http.middlewares.nifi-headers.headers.customRequestHeaders.X-ProxyPort=443"
- "traefik.http.middlewares.nifi-headers.headers.customRequestHeaders.X-ProxyContextPath:/"
# - "traefik.http.middlewares.nifi-redirect.redirectregex.permanent=true"
# - "traefik.http.middlewares.nifi-redirect.redirectregex.regex=^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?):8443"
# - "traefik.http.middlewares.nifi-redirect.redirectregex.replacement=mynifi:8443"
# - "traefik.http.middlewares.nifi-redirect.headers.sslforcehost=true"
# - "traefik.http.middlewares.nifi-redirect.headers.sslhost=mynifi"
# - "traefik.http.middlewares.nifi-tls.forwardauth.tls.insecureskipverify=true"
# Routers
- traefik.http.routers.nifi-flow.middlewares=nifi-headers
- traefik.http.routers.nifi-flow.service=nifi-flow
- traefik.http.routers.nifi-flow.entrypoints=$TRAEFIK_HTTPS_ENTRYPOINT
- traefik.http.routers.nifi-flow.tls=true
- traefik.http.routers.nifi-flow.rule=Host(`$DOCKER_HOST_URL`) && PathPrefix(`/nifi`)
restart_policy:
condition: on-failure
delay: 120s
max_attempts: 3
window: 60s
networks:
traefik_webgateway:
external: true
volumes:
nifi_conf: {external: true}
nifi_database_repository: {external: true}
nifi_flowfile_repository: {external: true}
nifi_content_repository: {external: true}
nifi_provenance_repository: {external: true}
nifi_state: {external: true}
nifi_logs: {external: true}
Traefik.toml file
#General
[api]
dashboard = true
[metrics]
[metrics.prometheus]
[ping]
[log]
level = "DEBUG"
filepath = "/traefik/logs/traefik/traefik.log"
format = "json"
[accessLog]
filePath = "/traefik/logs/access/access.log"
bufferingSize = 10
#ENTRYPOINTS
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.http]
[entryPoints.web.http.redirections]
[entryPoints.web.http.redirections.entryPoint]
to = "websecure"
scheme = "https"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.forwardedHeaders]
trustedIPs = ["<IP_Address>"] # f5
[entryPoints.websecure.http.tls]
[entryPoints.apiDashboard]
address = ':70000'
#MIDDLEWARES
[http.middlewares]
[http.middlewares.test-retry.retry]
attempts = 4
[http.middlewares.https-redirectscheme.redirectScheme]
scheme = "https"
permanent = true
#TLS
[[tls.certificates]]
certFile = "/folder/cert"
keyFile = "/folder/key"
#PROVIDERS
[providers]
providersThrottleDuration = 2
[providers.docker]
watch = true
endpoint = "unix:///var/run/docker.sock"
exposedByDefault = true
swarmMode = true
swarmModeRefreshSeconds = 15
network = "traefik_webgateway"
[providers.file]
filename = "/etc/traefik/traefik.toml"
watch = true