Skip to content

Instantly share code, notes, and snippets.

Last active May 29, 2022 01:32
Show Gist options
  • Save micw/67faf5cd3d4a6f64568ca2bb9a051230 to your computer and use it in GitHub Desktop.
Save micw/67faf5cd3d4a6f64568ca2bb9a051230 to your computer and use it in GitHub Desktop.
# This is an example how to pass acme challenges to a backend of a particular domain while
# all other acme challenges are solved by traefik
# Tested with traefik 1.7.7
# How it works:
# - an entry point listens at 81 which is used for traefik's acme. This port is not exposed
# - a default rule for /.well-known/acme-challenge/ is added for the http entry point. It has a priority of 1000
# and forwards acme requests to localhost:81 where traefik accepts acme challenges
# - for a particular domain, a rule with higher priority is added, so this domain's acme challenges are not sent to
# traefik
# Note: to make traefik issue certs automatically (via onHostRule), it is necessary that the rule is bound to the "acme"
# entrypoint (see
address = ":80"
address = ":81"
address = ":443"
email = ""
storage = "acme.json"
entryPoint = "https"
entryPoint = "acme"
url = ""
url = ""
entryPoints = ["http"]
backend = "acme"
passHostHeader = true
priority = 1000
rule = "PathPrefix:/.well-known/acme-challenge/"
entryPoints = ["http"]
backend = "backend1"
passHostHeader = false
priority = 1001
rule = ""
priority = 1001
Copy link

micw commented Dec 29, 2019

It works similar with traefik 2:

1st enable an extra entry point for acme (e.g. via CLI) and route config from a file (/etc/traefik/dynamic_conf.yml):

    command: |

In the config, add a default route for acme challenges with a priority of 1000:

          - url:
        - http
      rule: PathPrefix(`/.well-known/acme-challenge/`)
      priority: 1000
      service: acme

Now for every service that needs to solve acme itself, setup a http router with a priority >1000. Docker example:

      traefik.enable: "true"
      traefik.http.routers.rancher-http.rule: Host(``)
      traefik.http.routers.rancher-http.entryPoints: http
      traefik.http.routers.rancher-http.priority: 1001

Copy link

👍 Great solution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment