Shaarli: Docker compose example try to obtain a certificate for traefik.docker.docker.localhost

[oktomus]

Hi, I followed the documentation how to use Docker compose to run Shaarli.

It seems that traefik try to get a certificate for localhost, which fails.

traefik_1  | time="2020-11-08T15:37:52Z" level=debug msg="Try to challenge certificate for domain [shaarli.oktomus.com] founded in Host rule"
traefik_1  | time="2020-11-08T15:37:52Z" level=debug msg="Try to challenge certificate for domain [traefik.docker.docker.localhost] founded in Host rule"

...

traefik_1  | time="2020-11-08T15:37:53Z" level=error msg="Unable to obtain ACME certificate for domains \"traefik.docker.docker.localhost\" detected thanks to rule \"Host:traefik.docker.docker.localhost\" : unable to generate a certificate for the domains [traefik.docker.docker.localhost]: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:rejectedIdentifier :: Error creating new order :: Cannot issue for \"traefik.docker.docker.localhost\": Domain name does not end with a valid public suffix (TLD), url: "

This is the only error I get and my shaarli instance is not working.

Here is my docker-compose.yml file:

---
# Shaarli - Docker Compose example configuration
#
# See:
# - https://shaarli.readthedocs.io/en/master/docker/shaarli-images/
# - https://shaarli.readthedocs.io/en/master/guides/install-shaarli-with-debian9-and-docker/
#
# Environment variables:
# - SHAARLI_VIRTUAL_HOST      Fully Qualified Domain Name for the Shaarli instance
# - SHAARLI_LETSENCRYPT_EMAIL Contact email for certificate renewal
version: '3'

networks:
  http-proxy:

volumes:
  traefik-acme:
  shaarli-cache:
  shaarli-data:

services:
  shaarli:
    restart: always
    image: shaarli/shaarli:master
    build: ./
    networks:
      - http-proxy
    volumes:
      - shaarli-cache:/var/www/shaarli/cache
      - shaarli-data:/var/www/shaarli/data
    labels:
      traefik.domain: "${SHAARLI_VIRTUAL_HOST}"
      traefik.backend: shaarli
      traefik.frontend.rule: "Host:${SHAARLI_VIRTUAL_HOST}"

  traefik:
    restart: always
    image: traefik:1.7-alpine
    command:
      - "--logLevel=DEBUG"
      - "--defaultentrypoints=http,https"
      - "--entrypoints=Name:http Address::80 Redirect.EntryPoint:https"
      - "--entrypoints=Name:https Address::443 TLS"
      - "--retry"
      - "--docker"
      - "--docker.domain=docker.localhost"
      - "--docker.exposedbydefault=true"
      - "--docker.watch=true"
      - "--acme"
      - "--acme.domains=${SHAARLI_VIRTUAL_HOST}"
      - "--acme.email=${SHAARLI_LETSENCRYPT_EMAIL}"
      - "--acme.entrypoint=https"
      - "--acme.onhostrule=true"
      - "--acme.storage=/acme/acme.json"
      - "--acme.httpchallenge"
      - "--acme.httpchallenge.entrypoint=http"
    networks:
      - http-proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-acme:/acme

And my .env file:

$ cat .env
SHAARLI_VIRTUAL_HOST=shaarli.oktomus.com
SHAARLI_LETSENCRYPT_EMAIL=somemail

[ArthurHoaro]

Hi, thanks for the report!

You can fix your issue by replacing

- "--docker.domain=docker.localhost"

with

- "--docker.domain=${SHAARLI_VIRTUAL_HOST}"

I'll submit a PR to change that.

Also I see another issue, by default our docker-compose uses the master image which is a development branch. This should be a third parameter in the .env file.

[oktomus]

Thanks a lot !

[oktomus]

Unfortunately, that doesn't work for me. The error message is different. traefik.docker.docker.localhost changed to traefik.docker.shaarli.oktomus.com:

traefik_1  | time="2020-11-09T20:30:27Z" level=error msg="Unable to obtain ACME certificate for domains \"traefik.docker.shaarli.oktomus.com\" detected thanks to rule \"Host:traefik.docker.shaarli.oktomus.com\" : unable to generate a certificate for the domains [traefik.docker.shaarli.oktomus.com]: acme: Error -> One or more domains had a problem:\n[traefik.docker.shaarli.oktomus.com] acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for traefik.docker.shaarli.oktomus.com - check that a DNS record exists for this domain, url: \n"

[ArthurHoaro]

It's looks like a warning after it was generated once, because shaarli.oktomus.com has a valid Let's Encrypt certificate. However it also renders a blank page so there is probably another issue.

[oktomus]

It's up now :) I was trying to used a local-persistent volume so that I can easily backup & deploy my shaarli instance. The problem i have is that I need to manually sudo chown systemd-timesync:systemd-journal -R volumes/ before running the services. Otherwise I get permissions errors from shaarli.

I would like to set the volume owner to my user.

Here is the final docker-compose.yml I'm using:

version: '3'

networks:
  http-proxy:

volumes:
  traefik-acme:
  shaarli-cache:
    driver: local-persist
    driver_opts:
      mountpoint: /home/kevin/docker/volumes/shaarli-cache
  shaarli-data:
    driver: local-persist
    driver_opts:
      mountpoint: /home/kevin/docker/volumes/shaarli-data

services:
  shaarli:
    restart: always
    image: shaarli/shaarli:${SHAARLI_DOCKER_TAG}
    build: ./
    networks:
      - http-proxy
    volumes:
      - shaarli-cache:/var/www/shaarli/cache:rw
      - shaarli-data:/var/www/shaarli/data:rw
    labels:
      traefik.domain: "${SHAARLI_VIRTUAL_HOST}"
      traefik.backend: shaarli
      traefik.frontend.rule: "Host:${SHAARLI_VIRTUAL_HOST}"

  traefik:
    restart: always
    image: traefik:1.7-alpine
    command:
      - "--defaultentrypoints=http,https"
      - "--entrypoints=Name:http Address::80 Redirect.EntryPoint:https"
      - "--entrypoints=Name:https Address::443 TLS"
      - "--retry"
      - "--docker"
      - "--docker.domain=${SHAARLI_VIRTUAL_HOST}"
      - "--docker.exposedbydefault=true"
      - "--docker.watch=true"
      - "--acme"
      - "--acme.domains=${SHAARLI_VIRTUAL_HOST}"
      - "--acme.email=${SHAARLI_LETSENCRYPT_EMAIL}"
      - "--acme.entrypoint=https"
      - "--acme.onhostrule=true"
      - "--acme.storage=/acme/acme.json"
      - "--acme.httpchallenge"
      - "--acme.httpchallenge.entrypoint=http"
    networks:
      - http-proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-acme:/acme

[ArthurHoaro]

Yes Docker's volume permissions can be a bit messy. I'm glad that you were able to make it work, and thank you for the reference docker-compose.yml.