ACME (letsencrypt) interface or plugin about traefik

[emilevauge]

Hi @F0rth, I'm currently already working on that ^^

[jpillora]

👍 letsencrypt all the things!

[ludovicc]

There is a Go library (https://github.com/xenolf/lego) used by Caddy.

[emilevauge]

@ludovicc yep, I have seen what Caddy does with letsencrypt using lego. It would be awesome to add that feature in Traefik :)

[strarsis]

+1

[sheerun]

I'm also interested. Maybe running traefik on top of consul-template would work?

[strarsis]

https://github.com/emilevauge/traefik/issues/211, #217 and #212

[emilevauge]

Hi all, I created a traefik docker image with let's encrypt support: containous/traefik:add-lets-encrypt-suppport
I invite you to test it before the PR is merged ;)
Here is the new toml file to use:

defaultEntryPoints = ["http", "https"]

[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]

[acme]
email = "[email protected]"
# group domains to get SNA
domains = [["test.local1.com", "test.local2.com"], ["test.local4.com", "test.local3.com"]]
storageFile = "acme.json" # mount it in a volume ;)
# Uncomment to load SSL cert on demand (be careful)
#onDemand = true
# Uncomment the line to run on the staging let's encrypt server
# Leave comment to go to prod
# caServer = "https://acme-staging.api.letsencrypt.org/directory"
entryPoint = "http" #  must point to an entrypoint on port 80

Your feedback is welcome :)

[strarsis]

So the domains for the ACME client are listed in the domains option of acme key in configuration file.
Can this also be dynamically changed? Could one flag containers with an acme or even letsencrypt flag so traefik knows that the domains in the routes for these containers should have certs/keys requests over acme?

[emilevauge]

@strarsis, thanks for your feedback!
If you enable onDemand = true, traefik will dynamically download cert at the first request.
But, this is not perfect, I know that.
Maybe a new option on frontend, that would trigger cert download.
I was wondering if I had to rely directly on Host frontend rules, but they can be also wildcard :'(

[thorhs]

Maybe this could fit? https://github.com/dkumor/acmewrapper

[djmaze]

@emilevauge Letsencrypt does not (yet) support wildcard certificates, and generating certificates upon request is not desirable. So, in my opinion, if the Host rule contains a wildcard, ACME/SSL support should automatically be disabled for that particular frontend. Then certificates need to be generated only when a new frontend is added.

[djmaze]

@emilevauge Your toml file example works for me if I set defaultEntryPoints to just ["https"]. Otherwise Traefik only serves the backend service on port 80, and the .well-known directory is not reachable.