How to update Traefik file for use with staging/production domains

[BenA-SA]

Hi there,

First off, thank you to the contributors who keep this repository going! It's amazing.

I have a production server running a cookiecutter-django project using docker/traefik. I want to set up a staging environment on a separate domain to test things, however it doesn't seem to be as simple as adding the new domain Host information into the same places as the production domain name.

I also know very little about traefik, so struggling to understand where to look to try and get this working.

Would appreciate any suggestions anyone has!

Thanks

[foarsitter]

You need to add a service and a router. Can you post your config?

[BenA-SA]

Hi,

my traefik file is as follows:

I have obviously changed the email/production domain here for privacy.

I have tried adding the staging domain to the same line as the production domain, and also tried adding separate routers, but both still lead to traefik throwing an error in the staging environment as it it trying to verify against the production information.

Thanks for your reply!

log:
  level: INFO

entryPoints:
  web:
    # http
    address: ":80"
    http:
      # https://docs.traefik.io/routing/entrypoints/#entrypoint
      redirections:
        entryPoint:
          to: web-secure

  web-secure:
    # https
    address: ":443"

  flower:
    address: ":5555"

certificatesResolvers:
  letsencrypt:
    # https://docs.traefik.io/master/https/acme/#lets-encrypt
    acme:
      email: "my_email_here"
      storage: /etc/traefik/acme/acme.json
      # https://docs.traefik.io/master/https/acme/#httpchallenge
      httpChallenge:
        entryPoint: web

http:
  routers:
    web-secure-router:
      rule: "Host(`my_production_domain_here`) || Host(`my_production_domain_here`)"
      entryPoints:
        - web-secure
      middlewares:
        - csrf
      service: django
      tls:
        # https://docs.traefik.io/master/routing/routers/#certresolver
        certResolver: letsencrypt

    flower-secure-router:
      rule: "Host(`my_production_domain_here`)"
      entryPoints:
        - flower
      service: flower
      tls:
        # https://docs.traefik.io/master/routing/routers/#certresolver
        certResolver: letsencrypt

  middlewares:
    csrf:
      # https://docs.traefik.io/master/middlewares/headers/#hostsproxyheaders
      # https://docs.djangoproject.com/en/dev/ref/csrf/#ajax
      headers:
        hostsProxyHeaders: ["X-CSRFToken"]

  services:
    django:
      loadBalancer:
        servers:
          - url: http://django:5000

    flower:
      loadBalancer:
        servers:
          - url: http://flower:5555

providers:
  # https://docs.traefik.io/master/providers/file/
  file:
    filename: /etc/traefik/traefik.yml
    watch: true

[foarsitter]

Something like this I suppose:

log:
  level: INFO

entryPoints:
  web:
    # http
    address: ":80"
    http:
      # https://docs.traefik.io/routing/entrypoints/#entrypoint
      redirections:
        entryPoint:
          to: web-secure

  web-secure:
    # https
    address: ":443"

  flower:
    address: ":5555"

certificatesResolvers:
  letsencrypt:
    # https://docs.traefik.io/master/https/acme/#lets-encrypt
    acme:
      email: "my_email_here"
      storage: /etc/traefik/acme/acme.json
      # https://docs.traefik.io/master/https/acme/#httpchallenge
      httpChallenge:
        entryPoint: web

http:
  routers:
    staging-router:
      rule: "Host(`staging_domain`)"
      entryPoints:
        - web-secure
      middlewares:
        - csrf
      service: django-staging
      tls:
        # https://docs.traefik.io/master/routing/routers/#certresolver
        certResolver: letsencrypt
    web-secure-router:
      rule: "Host(`my_production_domain_here`) || Host(`my_production_domain_here`)"
      entryPoints:
        - web-secure
      middlewares:
        - csrf
      service: django
      tls:
        # https://docs.traefik.io/master/routing/routers/#certresolver
        certResolver: letsencrypt

    flower-secure-router:
      rule: "Host(`my_production_domain_here`)"
      entryPoints:
        - flower
      service: flower
      tls:
        # https://docs.traefik.io/master/routing/routers/#certresolver
        certResolver: letsencrypt

  middlewares:
    csrf:
      # https://docs.traefik.io/master/middlewares/headers/#hostsproxyheaders
      # https://docs.djangoproject.com/en/dev/ref/csrf/#ajax
      headers:
        hostsProxyHeaders: ["X-CSRFToken"]

  services:
    django:
      loadBalancer:
        servers:
          - url: http://django:5000
    django-staging:
      loadBalancer:
        servers:
          - url: http://django-staging:5000

    flower:
      loadBalancer:
        servers:
          - url: http://flower:5555

providers:
  # https://docs.traefik.io/master/providers/file/
  file:
    filename: /etc/traefik/traefik.yml
    watch: true

[BenA-SA]

I have made the changes you suggested however I am still getting the following error in the logs:

level=error msg="Unable to obtain ACME certificate for domains \"production_domain,www.production_domain\": unable to generate a certificate for the domains [production_domain www._production_domain_]: error: one or more domains had a problem:\n[production_domain]  acme: error: 403 :: urn:ietf:params:acme:error:unauthorized

Do I need to change my production.yml file or traefik Dockerfile to point it to the correct service?

I appreciate your efforts to help, thank you.

[foarsitter]

You need to adjust your DNS so your staging domain points to your traefik IP. And, ofcourse, you need to run you staging environment on your server in the same docker host.

[BenA-SA]

In case anyone comes across this in the future, I ended up making a .traefik environment file in my .envs/.production folder, referencing that in the production.yml file, then putting the domain name in there and using that environment variable in the traefik.yml file.

This allowed me to set the differing domains on both the staging and production servers using the env files, and kept my traefik.yml file the same for both systems.

Thanks to @foarsitter for taking the time to give me suggestions for this.