Deploying FastAPI with HTTPS powered by Traefik - docker

Question

i followed the guide for Deploying FastAPI with HTTPS powered by Traefik enter link description here
can someone tell me what changes should i make to access https
the docker compose consist 3 files
1)docker-compose.traefik.yml
services:
traefik:
# Use the latest v2.3.x Traefik image available
image: traefik:v2.3
ports:
# Listen on port 80, default for HTTP, necessary to redirect to HTTPS
- 80:80
# Listen on port 443, default for HTTPS
- 443:443
restart: always
volumes:
# Add Docker as a mounted volume, so that Traefik can read the labels of other services
- /var/run/docker.sock:/var/run/docker.sock:ro
# Mount the volume to store the certificates
# Mount the volume to store the certificates
- traefik-public-certificates:/certificates
command:
# Enable Docker in Traefik, so that it reads labels from Docker services
- --providers.docker
# Do not expose all Docker services, only the ones explicitly exposed
- --providers.docker.exposedbydefault=false
# Create an entrypoint "http" listening on port 80
- --entrypoints.http.address=:80
- --entrypoints.https.address=:443
# Create the certificate resolver "le" for Let's Encrypt, uses the environment variable EMAIL
- --certificatesresolvers.le.acme.email=spb7221#gmail.com
# Store the Let's Encrypt certificates in the mounted volume
- --certificatesresolvers.le.acme.storage=/certificates/acme.json
# Use the TLS Challenge for Let's Encrypt
- --certificatesresolvers.le.acme.tlschallenge=true
- --accesslog
# Enable the Traefik log, for configurations and errors
- --log
networks:
# Use the public network created to be shared between Traefik and
# any other service that needs to be publicly available with HTTPS
- traefik-public
volumes:
# Create a volume to store the certificates, there is a constraint to make sure
# Traefik is always deployed to the same Docker node with the same volume containing
# the HTTPS certificates
traefik-public-certificates:
networks:
# Use the previously created public network "traefik-public", shared with other
# services that need to be publicly available via this Traefik
traefik-public:
external: true
2)docker-compose.yml
#!/bin/bash
services:
backend:
build: .
command: uvicorn app.main:app --host 0.0.0.0 --port 8000
ports:
# Listen on port 80, default for HTTP, necessary to redirect to HTTPS
- 8000:8000
labels:
# Enable Traefik for this specific "backend" service
- traefik.enable=true
# Define the port inside of the Docker service to use
- traefik.http.services.app.loadbalancer.server.port=80
# Make Traefik use this domain in HTTP
- traefik.http.routers.app-http.entrypoints=http
- traefik.http.routers.app-http.rule=Host(`inskade.in`)
# Use the traefik-public network (declared below)
- traefik.docker.network=traefik-public
- traefik.http.routers.app-https.entrypoints=https
- traefik.http.routers.app-https.rule=Host(`inskade.in`)
- traefik.http.routers.app-https.tls=true
# Use the "le" (Let's Encrypt) resolver
- traefik.http.routers.app-https.tls.certresolver=le
# https-redirect middleware to redirect HTTP to HTTPS
- traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
- traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
# Middleware to redirect HTTP to HTTPS
- traefik.http.routers.app-http.middlewares=https-redirect
networks:
# Use the public network created to be shared between Traefik and
# any other service that needs to be publicly available with HTTPS
- traefik-public
networks:
traefik-public:
external: true
3)docker-compose.override.yml
services:
backend:
ports:
- 80:80
networks:
traefik-public:
external: false
here where i am checking the container
in browser I am able to access through http
i have checked the docker container of traefik and the certificate is present
the certificate
{
"le": {
"Account": {
"Email": "spb7221#gmail.com",
"Registration": {
"body": {
"status": "valid",
"contact": [
"mailto:spb7221#gmail.com"
]
},
"uri": "https://acme-v02.api.letsencrypt.org/acme/acct/45w5706050"
},
"PrivateKey": "MIIJJwIBAAKCAgEAqmkfY8MqLzdnq8IV573RdqNIIHIev0WDpd8Y3QnzaN9HN7U8wBRQIhpSf98bRbZ77UQOGwzzSCObU5KE9lx80anU0zKPDQV0
"KeyType": "4096"
},
"Certificates": [
{
"domain": {
"main": "inskade.in"
},
"certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS10tCk1JSUdHVENDQlFHZ0F3SUJBZ0lTQkV1aHo3WU1MdHJNUGV6QUlrTkc3OFVXTUEwR0NTcUdT
"key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFU1RSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBbkFLYzlNRFRQdUkxcW9sOWFYUEhHWTNlMFBDVWNyQ3NnaVFpS09Y
"Store": "default"
}
]
}
}

Answer 1

first, you should probably not post your certificates in plain clear sight, those are supposed to be private, especially "PrivateKey"
second, you are using traefik labels, and the names of these labels are relevant as you can see in the traefik docs
You named your docker service "backend" and should refer to it using this name so
- traefik.http.routers.app-https.entrypoints=https
changes to
- traefik.http.routers.backend.entrypoints=https
I didn't tested it but i think if you change every "app-https" and "app" with the correct "backend" name it should work.
last point, I do recommand putting the redirection from http to https in the traefik configuration, I personnaly use the following commands :
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --entrypoints.web.http.redirections.entrypoint.to=:443
- --entrypoints.web.http.redirections.entrypoint.scheme=https
- --entrypoints.web.http.redirections.entrypoint.permanent=true