How the proxy gets a certificate for every host, how to retry one that failed, and how to send other hosts to the website.
You need a server deployed as Deploy to a server says, with the proxy started.
The proxy asks Let's Encrypt for each host's certificate as soon as it starts. Until a certificate
arrives, the host answers with Traefik's own self-signed one. Plain http:// on DOMAIN and
MPA_DOMAIN answers a permanent redirect to HTTPS.
| Variable | What it does | Default |
|---|---|---|
TRAEFIK_ACME_EMAIL |
Where Let's Encrypt sends expiry notices. Set a real one. | empty |
TRAEFIK_CERT_RESOLVER |
The resolver the production routes ask for a certificate. | myresolver |
infra/compose/compose.proxy.yml defines that resolver: Let's Encrypt over port 80, with the
certificates in .volumes/traefik/letsencrypt/acme.json. The proxy serves nothing of its own but
/ping. Its dashboard and API are off, because they would list every project's routes.
On the server, find the host that got none:
docker logs traefikFix that host's DNS record, and wait until
dig +short <host>answers the server's address.Restart the proxy, in the app's directory on the server:
deno task proxy:stop && deno task proxy:start
Do not retry again and again while DNS is still wrong. Let's Encrypt allows 5 failed validations per host per hour, then gives one back every 12 minutes (rate limits). A deploy that recreates the app's containers also retries every host still without a certificate; a deploy that changes nothing does not.
Point each host's DNS record at the server.
In the env file, set
MPA_REDIRECT_RULEto a Traefik rule. Join hosts with||:MPA_REDIRECT_RULE=Host(`www.example.com`) || Host(`old.example.com`)Deploy. Each host then answers a permanent redirect to the same path on
MPA_DOMAIN, and Traefik gets its certificate.
The rule works in production only. Empty, it matches nothing.
- Deploy to a server: check the deployment.
- Run several projects on one server: share one Traefik.