Coolify behind another reverse proxy

[aleee-idk]

Hello!

I strugle for a couples of days for how to setup coolify behind another reverse proxy (Caddy in my case) without having duplicate certificates. For applications this wasn't a problem since I can control the traefik labels attached to the docker compose, but for services those labels are generated automatically and it adds the https routes and certresolver.

I knew the solutions couldn't be to complicated since coolify allows a lot of control over the proxy but the auto-generated labels gave me a lot of headache.

The solution in the end was to setup the domain of the service with HTTP (no HTTPS), with this simple action, the auto-generated TLS labels aren't included.

In retrospective it was pretty obvious but easily overlooked, I would suggest to add in the documentation or in the info popup this this behavior.

Here is my config in case somebody else is having a hard time:

Service example:

Treafik docker-compose.yml

version: '3.8'
networks:
  coolify:
    external: true
services:
  traefik:
    container_name: coolify-proxy
    image: 'traefik:v2.11'
    restart: unless-stopped
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    networks:
      - coolify
    ports:
      - '80:80'
      - '443:443'
      - '8080:8080'
    healthcheck:
      test: 'wget -qO- http://localhost:80/ping || exit 1'
      interval: 4s
      timeout: 2s
      retries: 5
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
      - '/data/coolify/proxy:/traefik'
    # environment:
      # - 'CF_DNS_API_TOKEN=super-secret-token'
    command:
      - '--ping=true'
      - '--ping.entrypoint=http'
      - '--api.dashboard=true'
      - '--api.insecure=true'
      - '--entrypoints.http.address=:80'
      - '--entryPoints.http.forwardedHeaders.trustedIPs=10.0.10.10'
      - '--entrypoints.https.address=:443'
      - '--entryPoints.https.forwardedHeaders.trustedIPs=10.0.10.10'
      - '--entrypoints.http.http.encodequerysemicolons=true'
      - '--entryPoints.http.http2.maxConcurrentStreams=50'
      - '--entrypoints.https.http.encodequerysemicolons=true'
      - '--entryPoints.https.http2.maxConcurrentStreams=50'
      - '--providers.docker.exposedbydefault=false'
      - '--providers.file.directory=/traefik/dynamic/'
      - '--providers.file.watch=true'
      # - '--certificatesresolvers.letsencrypt.acme.httpchallenge=true'
      # - '--certificatesresolvers.letsencrypt.acme.storage=/traefik/acme.json'
      # - '--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=http'
      # - '--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare'
      # - '--certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=0'
      - '--providers.docker=true'
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=http
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.services.traefik.loadbalancer.server.port=8080
      # - traefik.http.routers.traefik.tls.certresolver=letsencrypt
      # - traefik.http.routers.traefik.tls.domains[0].main=example.com
      # - traefik.http.routers.traefik.tls.domains[0].sans=*.example.com
      - coolify.managed=true

[vinicius507]

[aleee-idk]

Yeah, as I said:

The solution in the end was to setup the domain of the service with HTTP (no HTTPS), with this simple action, the auto-generated TLS labels aren't included.

Check the example I posted.

[mrn]

Thanks for this. Where is your docker-compose.yml for Traefik? Did you create it in /data/coolify/proxy?

[aleee-idk]

Yes, is in the default location where coolify creates it. You can update the config editing the file directly or via the WebApp in Servers > Localhost > Proxy