Hello Guys,
Two days now i'm trying to get rid of the weired behavior.
I have more than one server with same OS versions, running odoo behind a traefik reverse.
So, same configuration for docker-compose and traefik.toml. And on some of them, the minus 30 days certificate renewal fails with the bellow errors.
Logs are reporting a FW issue, but there is no FORWARD issue on port 443
Could you please provide support ?
My domains are: odoo12.imaginationsfertiles.fr and odoo12-test.imaginationsfertiles.fr
I ran this command: sudo docker-compose up -d --force-recreate
My docker-compose
version: "2.1"
services:
proxy:
image: traefik:latest
container_name: inverseproxy
environment:
TZ: "Europe/Paris"
networks:
shared:
aliases:
- odoo12.imaginationsfertiles.fr
- odoo12-test.imaginationsfertiles.fr
smtp:
private:
volumes:
- cert:/etc/traefik/acme:rw,Z
- logs:/var/log/traefik/:rw
- ./traefik.toml:/etc/traefik/traefik.toml:ro
ports:
- "80:80"
- "443:443"
depends_on:
- dockersocket
restart: unless-stopped
dockersocket:
image: tecnativa/docker-socket-proxy
container_name: inverseproxy_socket
privileged: true
userns_mode: "host"
networks:
private:
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
CONTAINERS: 1
NETWORKS: 1
SERVICES: 1
SWARM: 1
TASKS: 1
restart: unless-stopped
networks:
shared:
driver_opts:
encrypted: 1
smtp:
internal: true
driver_opts:
encrypted: 1
private:
internal: true
driver_opts:
encrypted: 1
volumes:
cert:
My traefik
entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.http]
[entryPoints.web.http.redirections]
[entryPoints.web.http.redirections.entryPoint]
to = "websecure"
scheme = "https"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http]
middlewares = ["security-headers@file", "limit@file", "compression@file"]
[entryPoints.websecure.http.tls]
options = "default"
certResolver = "le"
[providers]
[providers.docker]
endpoint = "http://dockersocket:2375"
exposedByDefault = false
network = "inverseproxy_shared"
[providers.file]
directory = "/etc/traefik"
[log]
level = "DEBUG"
[accesslog]
filePath = "/var/log/traefik/access.log"
[accessLog.fields]
defaultMode = "keep"
[accessLog.fields.headers]
defaultMode = "keep"
[accessLog.fields.names]
StartUTC = "drop"
[accessLog.filters]
statusCodes = "400-499"
[certificatesResolvers]
[certificatesResolvers.le]
[certificatesResolvers.le.acme]
email = "mco@mail"
storage = "/etc/traefik/acme/acme.json"
[certificatesResolvers.le.acme.tlsChallenge]
[http]
[http.middlewares]
[http.middlewares.security-headers.headers]
browserXssFilter = true
contentTypeNosniff = true
referrerPolicy = "same-origin"
forceSTSHeader = true
frameDeny = true
customFrameOptionsValue = "SAMEORIGIN"
sslRedirect = true
stsIncludeSubdomains = true
stsPreload = true
stsSeconds = 15552000
[http.middlewares.security-headers.headers.customResponseHeaders]
server = "" # Removes
[http.middlewares.compression.compress]
[http.middlewares.limit.buffering]
retryExpression = "IsNetworkError() && Attempts() < 5"
[http.middlewares.auth.basicAuth]
users = ["iffil:gdfgdgdfggdggdfqzrerer]
[http.middlewares.smtp-stripprefix.stripprefix]
prefixes = ["/smtp"]
[http.middlewares.norobot-headers.headers]
[http.middlewares.norobot-headers.headers.customResponseHeaders]
X-Robots-Tag = "noindex, nofollow"
[tls]
[tls.options]
[tls.options.default]
minVersion = "VersionTLS12"
sniStrict = true
cipherSuites = [
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_AES_256_GCM_SHA384",
"TLS_AES_128_GCM_SHA256",
"TLS_CHACHA20_POLY1305_SHA256",
"TLS_FALLBACK_SCSV" # Client is doing version fallback. See RFC 7507.
]
My web server is (include version):
Moved from traefik: v2.4 to traefik:latest
The operating system my web server runs on is (include version):
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.2 LTS"
I can login to a root shell on my machine (yes ):
And i get following error after runing the command#
"sudo docker-compose logs -f | grep -i error"
inverseproxy | time="2021-04-13T10:41:45+02:00" level=debug msg="Setting up buffering: request limits: 0 (mem), 0 (max), response limits: 0 (mem), 0 (max) with retry: 'IsNetworkError() && Attempts() < 5'" middlewareType=Buffer entryPointName=websecure routerName=websecure-odootest-restrict@docker middlewareName=limit@file
inverseproxy | time="2021-04-13T10:41:45+02:00" level=error msg="Error renewing certificate from LE: {odoo12-test.imaginationsfertiles.fr }, error: one or more domains had a problem:\n[odoo12-test.imaginationsfertiles.fr] acme: error: 400 :: urn:ietf:params:acme:error:connection :: Timeout during connect (likely firewall problem)\n" providerName=le.acme
inverseproxy | time="2021-04-13T10:41:47+02:00" level=debug msg="Setting up buffering: request limits: 0 (mem), 0 (max), response limits: 0 (mem), 0 (max) with retry: 'IsNetworkError() && Attempts() < 5'" middlewareName=limit@file middlewareType=Buffer entryPointName=websecure routerName=websecure-odootestsmtp@docker