Internal and external services running behind Traefik in Docker Swarm mode

Question

I'm having some trouble finding any way to make my situation workable. I have 2 applications:

1: External service web application running on sub1.domain.com. If I run this application behind traefik with acme (LetsEncrypt) it works fine. I have a few more backend services (api/auth) that all run with a valid LetsEncrypt certificate and get their http traffic redirected to https by traefik

[entryPoints.http.redirect]
  entryPoint = "https"

I have to have some form of http to https forwarding for this service.

2: Internal service web application running on sub2.domain.com. I have a self signed trusted certificate (internal CA) which works fine behind traefik if I set it as a default certificate, or if I use it in the application itself (inside tomcat). However, since it is an internal service I can live without ssl for this if it solves my problem. However, this does not work with traefik's http to https forwarding.

I have been trying to get these 2 services to run behind the same traefik instance but all the possible scenarios I could think of do not work because they are either still work in progress or just plain not working.

Scenarios

1: No http to https redirect, don't bother with https for the internal service and just use http. Then inside the backend for the external webservice redirect to https.

Problems:

• Unable to have 2 traefik ports which traefik forwards too Unable to forward 1 single port to another proto (since the backend is always either http or https port)
• Use ACME over the default cert

2: Use ACME over default certificate

someone else thought this was a good idea. It's just not working yet.

3: Re-use backend ssl certificate. Have traefik just redirect without "ssl termination". I'm not sure if this is the same thing but there is an option called "passTLSCert". However it seems that this is only possible with frontends defined in the .toml file which do not work (probably because I use docker for backends).

4: use DNS-01 challenge to create an SSL certificate for my internal service. Sounds like this could work, so I'm now using CloudFlare and have an api key. However, it does not seem to work for subdomains. and there is no reply on my issue report: https://github.com/containous/traefik/issues/1953

EDIT: I might be able to fix the issue described in 4 to get this to work. It seems the internal DNS might be conflicting with traefik

Answer 1

Someone decided that on our internal DNS zones would be added per subdomain, meaning that the SOA request returned the subdomain as the name. This does not play nice with cloudflare since the internal dns zone is not the same as the cloudflare dns.

Changing this to a main zone with a records for the subdomains fixed the issue (in combination with the delayDontCheckDNS option).