Traefik HTTPS entry points configurations not working via lets encrypt - docker

Question

Having some real issues getting HTTPS entrypoints working from my Traefik docker container.
I was trying to follow the guidelines over at https://docs.traefik.io/user-guide/docker-and-lets-encrypt/
Also have tried various bits from https://docs.traefik.io/user-guide/examples/ and https://ian-says.com/articles/traefik-proxy-docker-lets-encrypt/ and various other places
It all works fine in http, but https gives me a connection refused, and no https entrypoint is active in the traefik web portal.
When I check port 443 externally it says its closed, however there is no firewall, and its not already in use (see docker ps below), so all I can think is that the traefik container itself isn't setup correctly for https?
My question: How do I get HTTPS working on traefik? Also how do I see the traefik logs to get more info? docker-compose logs -f reverse-proxy is empty
traefik.toml
defaultEntryPoints = ["https","http"]
debug = true
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[acme]
email = "email#domain.com"
storage = "/home/project/acme.json"
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
entryPoint = "https"
[acme.httpChallenge]
entryPoint = "http"
[[acme.domains]]
main = "domain.com"
sans = ["app.domain.com", "api.domain.com"]
docker-compose.yml
version: '3'
services:
reverse-proxy:
image: traefik
command: --api --docker
ports:
- "80:80"
- "443:443"
- "8080:8080" # The Web UI (enabled by --api)
networks:
- web
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /opt/traefik/traefik.toml:/home/project/traefik.toml
- /opt/traefik/acme.json:/home/project/acme.json
api:
build:
context: ./api/
dockerfile: Dockerfile
volumes:
- ~/api:/var/www/html
networks:
- web
restart: always
labels:
- "traefik.enable=true"
- "traefik.frontend.rule=Host:api.domain.com"
- "traefik.docker.network=web"
webapp:
build:
context: ./webapp/
dockerfile: DockerfileNode
volumes:
- ~/webapp:/app
networks:
- web
labels:
- "traefik.frontend.rule=Host:app.domain.com"
- "traefik.docker.network=web"
- "traefik.enable=true"
expose:
- 8188
networks:
web:
external: true
screengrab of my traefik portal
(note: only http entry points, no https)
docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d956a9d25ace webapp "/usr/bin/kafka-sock…" 18 minutes ago Up 16 minutes 8188/tcp webapp_1
e46693c8ca3e api "docker-php-entrypoi…" 21 minutes ago Up 16 minutes 80/tcp api_1
321c5efc720b traefik "/traefik --api --do…" 2 hours ago Up 16 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:8080->8080/tcp reverse-proxy_1