在 Docker Swarm 上的 Traefik v2 中使用通配符证书

Question

我正在使用以下 Docker Compose 文件在 swarm 集群上部署 Traefik。

version: "3.7"

services:
  traefik:
    image: traefik:v2.1
    command:
      - "--api.dashboard=true"
      - "--accesslog=true"
      - "--log.level=INFO"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.swarmMode=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik-public"
      - "--providers.file.watch=true"
      - "--providers.file.filename=/file_provider.yml"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.provider=cloudflare"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.delayBeforeCheck=15"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53"
      - "--certificatesresolvers.letsencrypt.acme.email=user@domain.tld"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - 80:80
      - 443:443
    volumes:
      - traefik-certificates:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik-public
    environment:
      - "CF_API_EMAIL=user@domain.tld"
      - "CF_API_KEY=api-key"
    deploy:
      placement:
        constraints:
          - node.role == manager
      labels:
        - "traefik.enable=true"
        - "traefik.docker.lbswarm=true"
        - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
        - "traefik.http.routers.http-catchall.entrypoints=web"
        - "traefik.http.routers.http-catchall.middlewares=redirect-to-https@docker"
        - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
        - "traefik.http.routers.api.tls.certresolver=letsencrypt"
        - "traefik.http.routers.api.tls.domains[0].main=*.domain.tld"
        - "traefik.http.routers.api.tls.domains[0].sans=domain.tld"
        - "traefik.http.routers.api.rule=Host(`management.domain.tld`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
        - "traefik.http.routers.api.service=api@internal"
        - "traefik.http.services.api.loadbalancer.server.port=8080"
    configs:
      - file_provider.yml

volumes:
  traefik-certificates:

configs:
  file_provider.yml:
    file: /home/access/docker/traefik-provider.yml

networks:
  traefik-public:
    external: true

目前，我已达到management.domain.tld 的速率限制，而我想使用通配符证书，因此我再次遇到速率限制的可能性较小。我已将 Traefik 配置为生成有效的通配符证书，但日志中的 management.domain.tld 仍然存在速率限制错误。此外，当我在浏览器中转到 management.domain.tld 时，我收到一个无效的 SSL/TLS 错误。如何让 Traefik 使用通配符证书，而不是为每个主机规则颁发新证书？

Answer 1

看起来你做的一切都是正确的。但是配置有一点小错误。

main 是证书的Subject 字段。意思是证书颁发给的域/子域。

sans 是证书的Subject Alternate Names 字段。表示证书也适用的替代域/子域。

所以，不要使用：

version: "3.7"

services:
  traefik:
    image: traefik:v2.1
    ...
      labels:
        - "traefik.http.routers.api.tls.domains[0].main=*.domain.tld"
        - "traefik.http.routers.api.tls.domains[0].sans=domain.tld"
    ...

你应该使用：

version: "3.7"

services:
  traefik:
    image: traefik:v2.1
    ...
      labels:
        - "traefik.http.routers.api.tls.domains[0].main=domain.tld"
        - "traefik.http.routers.api.tls.domains[0].sans=*.domain.tld"
    ...