Docker Compose: missing tls=true label when certificateType is "none" with HTTPS enabled

[luigigorlero]

To Reproduce

When configuring a domain on a Docker Compose application with HTTPS enabled and certificateType set to None, Dokploy does not generate the tls=true Traefik label on the websecure router. This causes Traefik to not terminate TLS for that domain, resulting in a 404 for all HTTPS requests, even though the container is running correctly and the custom certificate is being properly used.

1. Upload a custom certificate in Settings → Certificates
2. Create a Docker Compose application
3. Add a domain with: HTTPS: ON / Certificate: None
4. Deploy the stack
5. Access the domain over HTTPS

Current vs. Expected behavior

The generated Docker Compose labels should include:

traefik.http.routers.<router-name>-websecure.tls=true

but the websecure router is generated without any TLS label

Compare this with certificateType: letsencrypt, which correctly generates:

- traefik.http.routers.<router-name>-websecure.tls.certresolver=letsencrypt

Workaround

Manually add the missing label directly in docker-compose.yml:

labels:
  - traefik.http.routers.<router-name>-websecure.tls=true

Provide environment information

Operating System:
  OS: Ubuntu 24.04.4 LTS
  Arch: arm64
Dokploy version: 0.28.6
VPS Provider: Hetzner

Which area(s) are affected? (Select all that apply)

Docker Compose

Are you deploying the applications where Dokploy is installed or on a remote server?

Same server where Dokploy is installed

Additional context

No response

Will you send a PR to fix it?

No

[dosubot]

Hi @luigigorlero! I'm Dosu and I’m helping the dokploy team.

Thanks for the detailed report! I can confirm this is a bug in Dokploy's label generation.

The issue is in packages/server/src/utils/docker/domain.ts - when certificateType="none", the code doesn't add any TLS labels:

if (entrypoint === "websecure") {
    if (certificateType === "letsencrypt") {
        labels.push(`traefik.http.routers.${routerName}.tls.certresolver=letsencrypt`);
    } else if (certificateType === "custom" && customCertResolver) {
        labels.push(`traefik.http.routers.${routerName}.tls.certresolver=${customCertResolver}`);
    }
    // Missing: else if (certificateType === "none") { ... }
}

Interestingly, regular (non-compose) applications handle this case differently in packages/server/src/utils/traefik/domain.ts, though they set tls = undefined which isn't quite right either for the custom certificate use case.

The fix would be adding:

} else if (certificateType === "none") {
    labels.push(`traefik.http.routers.${routerName}.tls=true`);
}

This enables TLS without specifying a cert resolver, allowing Traefik to use the custom certificate you uploaded.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[djleonskennedy]

This appears to be a high-severity issue. Do we have any forecast for when it will be fixed?

[luigigorlero]

This appears to be a high-severity issue. Do we have any forecast for when it will be fixed?

Is it ? It’s a Traefik misconfiguration that is workaroundable with a patch to your compose.