1.2.2 breaks endpoints, redirect loop

[zweizeichen]

What version of Traefik are you using (traefik version)?

1.2.2

What is your environment & configuration (arguments, toml...)?

Endpoints are added dynamically via Docker. Probably something is wrong with my configuration. 1.2.1 works, though.

traefikLogsFile = "data/traefik.log"
accessLogsFile = "data/access.log"
defaultEntryPoints = ["http", "https"]
[retry]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
[acme]
email = "mail@example.com"
storageFile = "data/acme.json"
onDemand = false
caServer = "https://acme-v01.api.letsencrypt.org/directory"
entryPoint = "https"
acmeLogging = true

[[acme.domains]]
  main = "example.com"

[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "example.com"
watch = true
exposedbydefault = false
swarmmode = false

What did you do?

Upgraded from 1.2.1 to 1.2.2.

What did you expect to see?

Normal operation.

What did you see instead?

All URLs result in a 302 loop.

If applicable, please paste the log output in debug mode (--debug switch)

> 255.255.255.255 - - [13/Apr/2017:07:15:58 +0000] "GET /my/url/ HTTP/2.0" 302 5 "" "User-Agent" 228 "" "" 0ms
> 255.255.255.255 - - [13/Apr/2017:07:15:58 +0000] "GET /my/url/ HTTP/2.0" 302 5 "" "User-Agent" 229 "" "" 0ms
> 255.255.255.255 - - [13/Apr/2017:07:15:58 +0000] "GET /my/url/ HTTP/2.0" 302 5 "" "User-Agent" 230 "" "" 0ms
> 255.255.255.255 - - [13/Apr/2017:07:15:58 +0000] "GET /my/url/ HTTP/2.0" 302 5 "" "User-Agent" 231 "" "" 0ms

[emilevauge]

Probably due to #1271. @argeiger any idea ?

[f3l1x]

Same by me. :(

[emilevauge]

@zweizeichen Could you give us your debug logs while starting traefik ? Can't reproduce it :'(

[emilevauge]

@f3l1x @sapk any chance to get some logs ?

[zyclonite]

only happens when running tls (in my case without acme)

a guess would be: v1.2.1...v1.2.2#diff-34c6b408d72845d076d47126c29948d1R315

[andrewcfitz]

I have the same issue, this config works in 1.2.1, but not in 1.2.2.

logLevel = "DEBUG"
defaultEntryPoints = ["http", "https"]

[web]
address = ":8080"

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
  [entryPoints.http.redirect]
  entryPoint = "https"

[acme]
email = "andrew@test.lan"
storage = "/etc/traefik/acme/acme.json"
entryPoint = "https"
acmeLogging = true
# onDemand = true
OnHostRule = true
#caServer = "https://acme-staging.api.letsencrypt.org/directory"

[[acme.domains]]
   main = "proxy.test.lan"

[file]

[backends]
  [backends.jenkins]
    [backends.jenkins.servers.server1]
    url = "http://10.0.0.43:8080"
    weight = 10
    passHostHeader = true
    [backends.jenkins.LoadBalancer]
      method = "wrr"

[frontends]
  [frontends.jenkins]
  entrypoints = ["http", "https"]
  backend = "jenkins"
    [frontends.jenkins.routes.hostname]
    rule = "Host:jenkins.test.lan"

time="2017-04-13T12:51:48Z" level=info msg="Traefik version v1.2.2 built on 2017-04-11_09:08:57PM"
time="2017-04-13T12:51:48Z" level=info msg="Using TOML configuration file /etc/traefik/traefik.toml"
time="2017-04-13T12:51:48Z" level=debug msg="Global configuration loaded {\"GraceTimeOut\":10,\"Debug\":false,\"CheckNewVersion\":true,\"AccessLogsFile\":\"\",\"TraefikLogsFile\":\"\",\"LogLevel\":\"DEBUG\",\"EntryPoints\":{\"http\":{\"Network\":\"\",\"Address\":\":80\",\"TLS\":null,\"Redirect\":{\"EntryPoint\":\"https\",\"Regex\":\"\",\"Replacement\":\"\"},\"Auth\":null,\"Compress\":false},\"https\":{\"Network\":\"\",\"Address\":\":443\",\"TLS\":{\"MinVersion\":\"\",\"CipherSuites\":null,\"Certificates\":null,\"ClientCAFiles\":null},\"Redirect\":null,\"Auth\":null,\"Compress\":false}},\"Cluster\":null,\"Constraints\":[],\"ACME\":{\"Email\":\"andrew@fitz.biz\",\"Domains\":[{\"Main\":\"proxy.test.lan\",\"SANs\":null}],\"Storage\":\"/etc/traefik/acme/acme.json\",\"StorageFile\":\"\",\"OnDemand\":false,\"OnHostRule\":true,\"CAServer\":\"\",\"EntryPoint\":\"https\",\"DNSProvider\":\"\",\"DelayDontCheckDNS\":0,\"ACMELogging\":true,\"TLSConfig\":null},\"DefaultEntryPoints\":[\"http\",\"https\"],\"ProvidersThrottleDuration\":2000000000,\"MaxIdleConnsPerHost\":200,\"InsecureSkipVerify\":false,\"Retry\":null,\"Docker\":null,\"File\":{\"Watch\":true,\"Filename\":\"/etc/traefik/traefik.toml\",\"Constraints\":null},\"Web\":{\"Address\":\":8080\",\"CertFile\":\"\",\"KeyFile\":\"\",\"ReadOnly\":false,\"Statistics\":null,\"Metrics\":null,\"Auth\":null},\"Marathon\":null,\"Consul\":null,\"ConsulCatalog\":null,\"Etcd\":null,\"Zookeeper\":null,\"Boltdb\":null,\"Kubernetes\":null,\"Mesos\":null,\"Eureka\":null,\"ECS\":null,\"Rancher\":null}"
time="2017-04-13T12:51:48Z" level=info msg="Preparing server http &{Network: Address::80 TLS:<nil> Redirect:0xc4203d3110 Auth:<nil> Compress:false}"
time="2017-04-13T12:51:48Z" level=info msg="Preparing server https &{Network: Address::443 TLS:0xc42004f6e0 Redirect:<nil> Auth:<nil> Compress:false}"
time="2017-04-13T12:51:48Z" level=info msg="Starting server on :80"
time="2017-04-13T12:51:48Z" level=info msg="Loading ACME Account..."
time="2017-04-13T12:51:48Z" level=info msg="Loaded ACME config from store /etc/traefik/acme/acme.json"
time="2017-04-13T12:51:48Z" level=debug msg="Building ACME client..."
time="2017-04-13T12:51:49Z" level=debug msg=AgreeToTOS...
time="2017-04-13T12:51:49Z" level=info msg="Starting provider *provider.File {\"Watch\":true,\"Filename\":\"/etc/traefik/traefik.toml\",\"Constraints\":null}"
time="2017-04-13T12:51:49Z" level=info msg="Starting provider *main.WebProvider {\"Address\":\":8080\",\"CertFile\":\"\",\"KeyFile\":\"\",\"ReadOnly\":false,\"Statistics\":null,\"Metrics\":null,\"Auth\":null}"
time="2017-04-13T12:51:49Z" level=info msg="Retrieving ACME certificates..."
time="2017-04-13T12:51:49Z" level=info msg="Retrieved ACME certificates"
time="2017-04-13T12:51:49Z" level=debug msg="Testing certificate renew..."
time="2017-04-13T12:51:49Z" level=info msg="Starting server on :443"
time="2017-04-13T12:51:49Z" level=debug msg="Configuration received from provider file: {\"backends\":{\"jenkins\":{\"servers\":{\"server1\":{\"url\":\"http://10.0.0.43:8080\",\"weight\":10}},\"loadBalancer\":{\"method\":\"wrr\"}}},\"frontends\":{\"jenkins\":{\"entryPoints\":[\"http\",\"https\"],\"backend\":\"jenkins\",\"routes\":{\"hostname\":{\"rule\":\"Host:jenkins.test.lan\"}},\"priority\":0}}}"
time="2017-04-13T12:51:49Z" level=debug msg="Last file config received more than 2s, OK"
time="2017-04-13T12:51:49Z" level=debug msg="Creating frontend jenkins"
time="2017-04-13T12:51:49Z" level=debug msg="Wiring frontend jenkins to entryPoint http"
time="2017-04-13T12:51:49Z" level=debug msg="Creating route hostname Host:jenkins.test.lan"
time="2017-04-13T12:51:49Z" level=debug msg="Creating entryPoint redirect http -> https : ^(?:https?:\\/\\/)?([\\w\\._-]+)(?::\\d+)?(.*)$ -> https://$1:443$2"
time="2017-04-13T12:51:49Z" level=debug msg="Creating backend jenkins"
time="2017-04-13T12:51:49Z" level=debug msg="Creating load-balancer wrr"
time="2017-04-13T12:51:49Z" level=debug msg="Creating server server1 at http://10.0.0.43:8080 with weight 10"
time="2017-04-13T12:51:49Z" level=debug msg="Wiring frontend jenkins to entryPoint https"
time="2017-04-13T12:51:49Z" level=debug msg="Creating route hostname Host:jenkins.test.lan"
time="2017-04-13T12:51:49Z" level=debug msg="Reusing backend jenkins"
time="2017-04-13T12:51:49Z" level=info msg="Server configuration reloaded on :80"
time="2017-04-13T12:51:49Z" level=info msg="Server configuration reloaded on :443"
time="2017-04-13T12:51:49Z" level=debug msg="LoadCertificateForDomains [jenkins.test.lan]..."
time="2017-04-13T12:52:02Z" level=debug msg="Challenge GetCertificate jenkins.test.lan"
time="2017-04-13T12:52:02Z" level=debug msg="ACME got domain cert jenkins.test.lan"

[sapk]

From browser log it seems that it redirect https://domain.tld/ to https://domain.tld:443/ and since the browser will clean :443 it is looping.
Example : https://try.gitea.io

[jm66]

Same here. Had to rollback to v1.2.1.

[argeiger]

@emilevauge, not sure why it is looping but diving in to see if I can find the cause. Didn't hit this scenario in my testing.

[purplefish32]

Same here, looping with acme

[argeiger]

@emilevauge found the possible cause and just want to verify with all of you via a possible workaround. Do you all have the following defined in the frontend:

entrypoints = ["http", "https"]

If so, can you take out http, the default entrypoint will take care of http and the redirect.

Problem is the http handlers are being reused for https in this case:

time="2017-04-13T12:51:49Z" level=debug msg="Reusing backend jenkins"

[andrewcfitz]

I tried both defaultEntryPoints = ["https", "http"] and defaultEntryPoints = ["https"], neither of them helped.