在Docker Swarm上的Traefik v2中使用通配符证书

Question

我正在使用以下Docker Compose文件在群集集群上部署Traefik。

version: "3.7"

services:
  traefik:
    image: traefik:v2.1
    command:
      - "--api.dashboard=true"
      - "--accesslog=true"
      - "--log.level=INFO"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.swarmMode=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik-public"
      - "--providers.file.watch=true"
      - "--providers.file.filename=/file_provider.yml"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.provider=cloudflare"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.delayBeforeCheck=15"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53"
      - "--certificatesresolvers.letsencrypt.acme.email=user@domain.tld"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - 80:80
      - 443:443
    volumes:
      - traefik-certificates:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik-public
    environment:
      - "CF_API_EMAIL=user@domain.tld"
      - "CF_API_KEY=api-key"
    deploy:
      placement:
        constraints:
          - node.role == manager
      labels:
        - "traefik.enable=true"
        - "traefik.docker.lbswarm=true"
        - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
        - "traefik.http.routers.http-catchall.entrypoints=web"
        - "traefik.http.routers.http-catchall.middlewares=redirect-to-https@docker"
        - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
        - "traefik.http.routers.api.tls.certresolver=letsencrypt"
        - "traefik.http.routers.api.tls.domains[0].main=*.domain.tld"
        - "traefik.http.routers.api.tls.domains[0].sans=domain.tld"
        - "traefik.http.routers.api.rule=Host(`management.domain.tld`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
        - "traefik.http.routers.api.service=api@internal"
        - "traefik.http.services.api.loadbalancer.server.port=8080"
    configs:
      - file_provider.yml

volumes:
  traefik-certificates:

configs:
  file_provider.yml:
    file: /home/access/docker/traefik-provider.yml

networks:
  traefik-public:
    external: true

此刻，我已经达到management.domain.tld上的速率限制，而我想使用通配符证书，因此不太可能再次遇到速率限制。我已将Traefik配置为生成可以使用的通配符证书，但是日志中management.domain.tld上仍然存在速率限制错误。另外，当我在浏览器中转到management.domain.tld时，收到无效的SSL / TLS错误。如何让Traefik使用通配符证书而不是为每个主机规则颁发新证书？

Answer 1

看起来您做对了所有事情。但是配置中有一个小错误。

main是证书的Subject字段。表示要向其颁发证书的域/子域。

sans是证书的Subject Alternate Names字段。表示证书也对其有效的备用域/子域。

因此，不要使用：

version: "3.7"

services:
  traefik:
    image: traefik:v2.1
    ...
      labels:
        - "traefik.http.routers.api.tls.domains[0].main=*.domain.tld"
        - "traefik.http.routers.api.tls.domains[0].sans=domain.tld"
    ...

您应该使用：

version: "3.7"

services:
  traefik:
    image: traefik:v2.1
    ...
      labels:
        - "traefik.http.routers.api.tls.domains[0].main=domain.tld"
        - "traefik.http.routers.api.tls.domains[0].sans=*.domain.tld"
    ...