traefik: httpChallenge entrypoint set unconditionally, breaks dnsChallenge-based cert renewal

[ineedjet]

Summary

apps/traefik/docker-compose.yml unconditionally sets an HTTP-01 challenge
entrypoint on the acmeresolver, even when a DNS-01 provider is configured:

x-vault-env: &vault-env
  TRAEFIK_CERTIFICATESRESOLVERS_ACMERESOLVER_ACME_EMAIL: ${ADMIN_MAIL}
  TRAEFIK_CERTIFICATESRESOLVERS_ACMERESOLVER_ACME_DNSCHALLENGE_PROVIDER: ${DNS_CHALLENGE_PROVIDER:-}
...
x-internal-env: &internal-env
  ...
  TRAEFIK_CERTIFICATESRESOLVERS_ACMERESOLVER_ACME_HTTPCHALLENGE_ENTRYPOINT: /letsencrypt/acme.json
  TRAEFIK_CERTIFICATESRESOLVERS_ACMERESOLVER_ACME_HTTPCHALLENGE_ENTRYPOINT: http

When both dnsChallenge and httpChallenge are set on the same
certificatesResolver, Traefik picks http-01 and silently ignores the
configured DNS provider/token. Confirmed from a live Traefik 3.7.13
instance's startup logs (target has DNS_CHALLENGE_PROVIDER=cloudflare and
a valid CF_DNS_API_TOKEN set):

INF Use solver.  domain=speedtest-tracker.mainframe.my lib=lego type=http-01
INF http01: Trying to solve HTTP-01.  domain=speedtest-tracker.mainframe.my lib=lego

The HTTP-01 challenge then fails for every domain: ACME requests to
/.well-known/acme-challenge/... reach Traefik on the http entrypoint but
get routed straight to the target app's own container (e.g. podsync@docker)
instead of being intercepted by Traefik's built-in ACME challenge handler,
so Let's Encrypt gets a plain 404 from the app:

ERR Unable to obtain ACME certificate for domains  error="unable to generate a certificate for the domains [podsync.dupmachine.com]: resolver: one or more domains had a problem: [podsync.dupmachine.com: invalid authorization: acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 2606:4700:3032::6815:1e4b: Invalid response from http://podsync.dupmachine.com/.well-known/acme-challenge/...: 404]"

Impact

Any target that relies on DNS-01 (e.g. because port 80/443 challenge
traffic can't be trusted to route correctly, or simply because DNS-01 was
the intended issuance method) silently gets HTTP-01 instead, which then
fails outright. Certificate renewal for the whole Traefik instance stops
working — not just for one app. On the target that surfaced this, most
*.dupmachine.com certs issued around mid-August had already expired by
early September and were not renewing; even certs issued as recently as
early September were already expired again days later, since every renewal
attempt errors out.

Expected behavior

httpChallenge should only be configured when no DNS challenge provider is
set, e.g.:

x-internal-env: &internal-env
  TRAEFIK_CERTIFICATESRESOLVERS_ACMERESOLVER_ACME_HTTPCHALLENGE_ENTRYPOINT: ${DNS_CHALLENGE_PROVIDER:+}http

or conditionally omit the env var entirely when DNS_CHALLENGE_PROVIDER is
set, so dnsChallenge is the only challenge type configured on the
resolver whenever a DNS provider is present.

Environment

• Traefik image: traefik (3.7.13, built 2026-09-04)
• Config path: apps/traefik/docker-compose.yml
• Reproduced via a target manifest with:

  DNS_CHALLENGE_PROVIDER: cloudflare
  DNS_CHALLENGE_TOKEN: <redacted, valid Cloudflare token>