moved from certs.json to acme.json

not necessary anymore

.gitignore

@@ -1,2 +1,2 @@
 /.env*
-/certs.json
+/acme.json

docker-compose.yml

@@ -13,10 +13,13 @@ services:
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.provider=${TRAEFIK_DNSPROVIDER}
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.resolvers=${TRAEFIK_DNSRESOLVERS}
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.email=${LETSENCRYPT_EMAIL}
-      - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.keytype=RSA4096
+      - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.keytype=EC384
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.storage=/certs.json
-      # we listen on both HTTP and HTTPS
+      # we listen on both HTTP and HTTPS and redirect
       - --entrypoints.http.address=:80
+      - --entrypoints.http.http.redirections.entrypoint.to=https
+      - --entrypoints.http.http.redirections.entrypoint.scheme=https
+      - --entrypoints.http.http.redirections.entrypoint.permanent=true
       - --entrypoints.https.address=:443
       # logging level
       - --log.level=${TRAEFIK_LOGLEVEL}
@@ -35,7 +38,7 @@ services:
       - traefik.enable=${TRAEFIK_ENABLED}
       - traefik.docker.network=${TRAEFIK_NETWORK}
       # configure a global whitelist for accessing the Træfik dashboard
-      - traefik.http.middlewares.dashboard-whitelist.ipwhitelist.sourcerange=${TRAEFIK_DASHBOARD_WHITELIST}
+      - traefik.http.middlewares.dashboard-whitelist.ipallowlist.sourcerange=${TRAEFIK_DASHBOARD_WHITELIST}
       # configure a global middleware for redirecting HTTP to HTTPS
       - traefik.http.middlewares.http-to-https.redirectscheme.scheme=https
       - traefik.http.middlewares.http-to-https.redirectscheme.permanent=true
@@ -43,21 +46,15 @@ services:
       - traefik.http.middlewares.hsts.headers.stsSeconds=${TRAEFIK_STS_SECONDS}
       - traefik.http.middlewares.hsts.headers.stsIncludeSubdomains=${TRAEFIK_STS_SUBDOMAINS}
       - traefik.http.middlewares.hsts.headers.stsPreload=${TRAEFIK_STS_PRELOAD}
-      ### Section HTTP
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.entrypoints=http
-      # redirect Træfik dashboard to HTTPS only
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTP_MIDDLEWARES}
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.service=api@internal
-      ### Section HTTPS
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.entrypoints=https
+      # HTTPS
+      - traefik.http.routers.${TRAEFIK_ROUTER}.entrypoints=https
       # configure Træfik dashboard to be the exposed service
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTPS_MIDDLEWARES}
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.service=api@internal
+      - traefik.http.routers.${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTPS_MIDDLEWARES}
+      - traefik.http.routers.${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
+      - traefik.http.routers.${TRAEFIK_ROUTER}.service=api@internal
       # of course, enable TLS and it's certificate provider
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls=${TRAEFIK_TLSENABLED}
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
+      - traefik.http.routers.${TRAEFIK_ROUTER}.tls=${TRAEFIK_TLSENABLED}
+      - traefik.http.routers.${TRAEFIK_ROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
     networks:
       - traefik
     ports:

env.example

@@ -4,9 +4,8 @@ TRAEFIK_CERTRESOLVER=letsencrypt
 TRAEFIK_DASHBOARD_WHITELIST=1.2.3.4/24
 TRAEFIK_ENABLED=true
 TRAEFIK_NETWORK=traefik
-TRAEFIK_MATCHRULE=Host(`traefik.mydomain.com`)
-TRAEFIK_ROUTER=traefik_mydomain_com
-TRAEFIK_HTTP_MIDDLEWARES=dashboard-whitelist,http-to-https
+TRAEFIK_MATCHRULE=Host(`traefik.example.com`)
+TRAEFIK_ROUTER=traefik_example_com
 TRAEFIK_HTTPS_MIDDLEWARES=dashboard-whitelist,hsts
 
 # Security
@@ -19,7 +18,7 @@ TRAEFIK_STS_PRELOAD=true
 TRAEFIK_DNSPROVIDER=hetzner
 TRAEFIK_DNSPROVIDER_ENVFILE=./.env.dnsprovider
 TRAEFIK_DNSRESOLVERS=1.1.1.1:53,1.0.0.1:53
-LETSENCRYPT_EMAIL=admin@mydomain.com
+LETSENCRYPT_EMAIL=admin@example.com
 
 # Debugging
 TRAEFIK_ACCESSLOG=false
@@ -27,4 +26,4 @@ TRAEFIK_LOGLEVEL=INFO
 
 # Volumes
 TRAEFIK_DYNAMIC=./config
-TRAEFIK_CERTFILE=./certs.json
+TRAEFIK_CERTFILE=./acme.json