NS8 and DNS-01 wildcard certificates

Feature
8

Hi everybody

I was able to retrieve my first test certificate using DNS-01 challenge :grinning: and I hope we can bring this feature a step further.

  1. Log into the traefik module with runagent -m traefik1
  2. Edit traefik.yaml with the help of Let's Encrypt | Traefik | v2.4 by choosing your provider:
defaultEntryPoints:
- http
- https
file: {}
log:
  level: INFO
  noColor: true
accessLog: {}
entryPoints:
  http:
    address: :80
  https:
    address: :443
providers:
  file:
    directory: /etc/traefik/configs
tls:
  certResolver: acmeServer
  options: {}
certificatesResolvers:
  acmeServer:
    acme:
      email: 'homer@springfield.com'
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
      storage: /etc/traefik/acme/acme.json
      dnsChallenge:
        provider: infomaniak
        delayBeforeCheck: 3
ping:
  manualRouting: true
api: {}
core:
  defaultRuleSyntax: v3
  1. The trickiest part was to set the environment variable INFOMANIAK_ACCESS_TOKEN for my DNS provider Infomaniak.
    I have added the environment variable for the token to the service ../systemd/user/traefik.service as described here: Custom ACME Server - tls error to server - #6 by Tbaile
--env=INFOMANIAK_ACCESS_TOKEN=<my-token> \
  1. Reload systemd with systemctl --user daemon-reload
  2. Restart traefik service with systemctl --user restart traefik

Finally I was able to create the certificate (I had to increase the default timeout):

[root@test ~]# api-cli run module/traefik1/set-certificate --data '{"fqdn":"test1.mydomain.com", "sync_timeout":120}'
Warning: using user "cluster" credentials from the environment
{"obtained": true}

However, I don’t like the part with editing the service file. Does anybody know a better way?

4 Likes