Traeffic, Docker and Let's Encrypt - docker

Question

Final stage before my website can finally go live --> SSL.
I'm using a Jekyll site, with Traefic as a reverse proxy, Docker to prevent "it works on my machine" and Let's Encrypt for SSL. Looking at the docs this should be a walk in the park, but (as everything in software development) it is harder then it seems.
My current Traefic configuration:
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
permanent = true
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "johanvergeer.com"
watch = true
exposedByDefault = true
usebindportip = true
swarmMode = true
[acme]
email = "johanvergeer#gmail.com"
storage = "acme.json"
entryPoint = "https"
acmeLogging = true
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
[[acme.domains]]
main = "johanvergeer.com"
[acme.httpChallenge]
entryPoint = "http"
provider = "digitalocean"
And the docker-compose file
version: "3.6"
services:
site:
ports:
- 4000:4000
image: registry.gitlab.com/johanvergeer/redgyro/site:latest
deploy:
labels:
- traefik.site.port=4000
- traefik.enable=true
- traefik.frontend.rule=Host:johanvergeer.com
- traefik.frontend.entryPoints=http,https
- traefik.docker.network=traefik-net
- traefik.backend.loadbalancer.method=drr
networks:
- traefik-net
reverse-proxy:
image: traefik # The official Traefik docker image
ports:
- "80:80" # The HTTP port
- "8080:8080" # The Web UI (enabled by --api)
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
- $PWD/traefik.toml:/etc/traefik/traefik.toml
- $PWD/acme.json:/etc/traefik/acme.json
deploy:
labels:
- traefik.site.port=80
- traefik.logLevel=DEBUG
- traefik.docker.network=traefik-net
- traefik.backend.loadbalancer.method=drr
placement:
constraints:
- node.role == manager
update_config:
parallelism: 1
delay: 10s
restart_policy:
condition: on-failure
networks:
- traefik-net
networks:
traefik-net:
name: traefik-net
At this moment I don't even receive anything in the Traefic logs, while it is set on DEBUG.
The browser shows an error Your connection is not private and NET::ERR_CERT_AUTHORITY_INVALID.
Does anyone know how to solve this?

Answer 1

httpChallenge does not accept a provider param. You could try removing that.
If that doesn't work and you're running on DigitalOcean try doing a dnsChallenge instead of an httpChallenge. To do so modify your traefik.toml from this:
[acme.httpChallenge]
entryPoint = "http"
provider = "digitalocean"
To this:
[acme.dnsChallenge]
provider = "digitalocean"
delayBeforeCheck = 0
And pass in the DO_AUTH_TOKEN environment variable as specified here. If you anticipate adding subdomains later DNS challenge with wildcard domains is the way to go.
Also consider removing caServer from your config so you default to production in case you've hit the Let's Encrypto Rate Limit for staging.
You could also try asking for help on the Let's Encrypt Community Support forum if you haven't yet.