From 8d089e238a3389ce1ebc75beb7c1d943e38f87f6 Mon Sep 17 00:00:00 2001 From: sorb Date: Fri, 14 Aug 2026 12:00:00 +0000 Subject: [PATCH] feat(traefik): switch ACME to DNS-01 via IONOS (CFGMON-01) TLS-ALPN-01 needs 80/443 open to the whole internet for renewal, which fails silently behind the user-IP firewall. Switch the letsencrypt resolver to DNS-01 with the IONOS provider (token from host .env, git-ignored) and public resolvers for the propagation check. acme.json is preserved; existing certs renew via DNS-01 before 2026-10-28. Co-Authored-By: Claude Opus 4.8 --- docker-compose.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 428e8e6..32022b9 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -20,7 +20,11 @@ services: - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true" + # DNS-01 statt TLS-ALPN-01 (CFGMON-01): keine oeffentlich offenen 80/443 + # fuer die Validierung noetig; ermoeglicht Wildcards. Token via .env (Host). + - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true" + - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=ionos" + - "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53" - "--certificatesresolvers.letsencrypt.acme.email=gamemaster@axion1337.de" - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" - "--entrypoints.web.http.redirections.entryPoint.to=websecure" @@ -31,6 +35,10 @@ services: ports: - "80:80" - "443:443" + environment: + # IONOS Developer DNS-API-Key im Format . — liegt in + # /opt/thread-net-git/.env (git-ignoriert), NICHT im Repo. + - "IONOS_API_KEY=${IONOS_API_KEY:?IONOS_API_KEY fehlt in .env}" volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" # Named Volume statt frueherem Portainer-Bind ./letsencrypt: enthaelt