sorb/thread-net-git
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(traefik): switch ACME to DNS-01 via IONOS (CFGMON-01)

Browse Source 
TLS-ALPN-01 needs 80/443 open to the whole internet for renewal, which fails
silently behind the user-IP firewall. Switch the letsencrypt resolver to
DNS-01 with the IONOS provider (token from host .env, git-ignored) and public
resolvers for the propagation check. acme.json is preserved; existing certs
renew via DNS-01 before 2026-10-28.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
sorb
2026-08-14 12:00:00 +00:00
co-authored by Claude Opus 4.8
parent 2f4a15ce85
commit 8d089e238a
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.yml
+9 -1
View File
@@ -20,7 +20,11 @@ services:
- "--providers.docker.exposedbydefault=false" - "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80" - "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443" - "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.letsencrypt.acme.tlschallenge=true" # DNS-01 statt TLS-ALPN-01 (CFGMON-01): keine oeffentlich offenen 80/443
# fuer die Validierung noetig; ermoeglicht Wildcards. Token via .env (Host).
- "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=ionos"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
- "--certificatesresolvers.letsencrypt.acme.email=gamemaster@axion1337.de" - "--certificatesresolvers.letsencrypt.acme.email=gamemaster@axion1337.de"
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
- "--entrypoints.web.http.redirections.entryPoint.to=websecure" - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
@@ -31,6 +35,10 @@ services:
ports: ports:
- "80:80" - "80:80"
- "443:443" - "443:443"
environment:
# IONOS Developer DNS-API-Key im Format <prefix>.<secret> — liegt in
# /opt/thread-net-git/.env (git-ignoriert), NICHT im Repo.
- "IONOS_API_KEY=${IONOS_API_KEY:?IONOS_API_KEY fehlt in .env}"
volumes: volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro" - "/var/run/docker.sock:/var/run/docker.sock:ro"
# Named Volume statt frueherem Portainer-Bind ./letsencrypt: enthaelt # Named Volume statt frueherem Portainer-Bind ./letsencrypt: enthaelt