TLS parameters from more dynamic providers and a default path for a no-config setup

[stellirin]

Do you want to request a feature or report a bug?

Feature

What did you expect to see?

Right now I use a Docker Compose file and configure everything as static configuration on the Traefik service command line, or dynamic configuration as labels on my various services.

I have a requirement to use a specific custom wildcard TLS certificate for all services.

This setup is possible today in Traefik v2.0, but I must provide a file to the Traefik service with the tls.certificates and tls.options parameters. Currently the TLS parameters cannot be set using labels.

To eliminate the additional configuration file, the TLS parameters should be possible to set from container labels, and to designate a default path for default certificates that is automatically picked up by Traefik.

The current documentation does not mention if a default path already exists, all examples use dummy /path/to paths.

[dduportal]

Hi @stellirin , thanks for reporting!

Could you elaborate a bit please? Is the path to the certificate would be a path inside the traefik container?

• If yes, what is exactly the issue you're having with specifying a file for the dynamic configuration to Traefik?
• If no, where would be this certificate stored? How Traefik could pick it exactly?

Thanks a lot!

[stellirin]

The certificate is bind mounted inside the container, and I specify the path in my configuration file (also bind mounted to the container) with tls.stores.default.defaultCertificate as described at https://docs.traefik.io/https/tls/#default-certificate

The issue is that (according to the same page above) this path cannot be set by dynamic configuration from the Docker provider, eg a trafek.tls.etc label on the traefik container. ( I did anyway try a couple of label variants but nothing seemed to work)

A 'nice to have' would be to allow all of the dynamic tls.etc parameters to be set as labels on the Traefik container.

A second 'nice to have' would be for Traefik to check a default path inside the container for a TLS certificate and use that certificate automatically for the default certificate. This would allow a 'zero config' variant of using a custom TLS certificate.

Example:

docker-compose.yaml:

services:
  traefik:
    image: traefik:2.0
    restart: always
    command:
      - "--log.level=DEBUG"
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.https.address=:443"
      # Default TLS certificates must be specified in a file :sadface:
      - "--providers.file.filename=/traefik/traefik.yaml"
    labels:
      - "traefik.enable=true"
      # Middleware to redirect HTTP to HTTPS
      - "traefik.http.middlewares.http-redirect.redirectregex.permanent=true"
      - "traefik.http.middlewares.http-redirect.redirectregex.regex=^http://(.*)"
      - "traefik.http.middlewares.http-redirect.redirectregex.replacement=https://$${1}"
      # HTTP Redirect
      - "traefik.http.routers.http-redirect.entrypoints=http"
      - "traefik.http.routers.http-redirect.rule=HostRegexp(`{subdomain:(.+\.)?}example.com`)"
      - "traefik.http.routers.http-redirect.service=api@internal"
      - "traefik.http.routers.http-redirect.middlewares=http-redirect@docker"
      # Traefik Dashboard
      - "traefik.http.routers.traefik.entrypoints=https"
      - "traefik.http.routers.traefik.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls=true"
    ports:
      - 80:80
      - 443:443
    volumes:
      - type: bind
        source: ./traefik
        target: /traefik
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock

traefik.yaml:

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_RSA_WITH_AES_256_GCM_SHA384
  stores:
    default:
      defaultCertificate:
        certFile: /traefik/fullchain.cert.pem
        keyFile: /traefik/key.pem

[johnsondnz]

+1 this. Currently there is no way to define ciphers or turn off TLS 1.1 or TLS 1.2 with dynamic service discovery.

Configuring via traefik.yaml:

tls:
  options:
    default:
      sniStrict: true
      minVersion: VersionTLS12
      cipherSuites: 
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
    mintls13:
      minVersion: VersionTLS13

Reference from docker-compose.yml

---
version: '3.2'

services:
  webservice:
    deploy:
      [...truncated...]
      labels:
        traefik.http.routers.router0.tls.options: default  # Call TLS config
      [...truncated...]

This is not applied as viewed from ssllabs.com

[ldez]

it's possible to set (but not define) tls.options using docker with the label traefik.http.routers.<router_name>.tls.options.

https://docs.traefik.io/v2.0/routing/providers/docker/#routers

[dduportal]

Hi @jhmnieuwenhuis can you switch to the community forum at http://community.containo.us, as your problem is not related to the initial issue. Thanks a lot!

[dverhelst]

This would alleviate the requirement to manage/deploy custom files for a true cloud-native router and become platform-agnostic.

[Seoka]

I would appreciate this feature to. I already opened a "ticket" in the community forum.

[bf8392]

+1

[alebeta90]

It would be great to have this possibility... it would make sense to keep the deployment simple without the need to create config files in the filesystem level

[dduportal]

Hi @alebeta90 @dverhelst , could you please elaborate? What would be the use case and the "how to" ? I'm speaking only for myself, but I don't understand what you are expecting: certificates are files, so I'm not sure where they should be located if not provided to Traefik?

"Cloud native" does not mean "stateless", but it means "providing automated primitives for operational tasks: Kubernetes, Docker are providing, for instance, the concept of "secrets", which are made for storing sensitive data, and mounting them in an automated way in pods/containers: filesystems have easy-to-manage access control with the unix rights, and use tmpfs (encrypted memory filesystem) for these mounts.
Traefik, as a cloud native solution, is able to manage Kubernetes secrets and retrieve it without any need for mount natively.

The issue here is about the way to configure TLS, where the question is "can we simplify" ? But if you set on container labels a path related to the traefik containers, you gain a few lines of configuration, but you risk confusion as the filesystem of the container where the label are put does NOT contains the specified certificate, which is not easy to get in term of UX.

It would really be interesting to hear your use case and how you see things in details :)