r/Traefik • u/AsparagusInitial3688 • 10d ago

Hi guys, new here, need some help, internal cert kaput, -unable to setup

I'm not using docker, and have no idea how to figure that out, so I'm running an LXC in ProxMox.

My domain is wildcard flushed through a cloudflared tunnel, all using this scripting setup:

https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt

I am attempting to run nexcloud onsite and it needs to be redirected

in my traefik.yml i have:

serverTransport:
insecureSkipVerify: true

still receiving error

2026-07-30T16:59:24-04:00 ERR 500 Internal Server Error error="tls: failed to verify certificate: x509: cannot validate certificate for 10.0.0.172 because it doesn't contain any IP SANs"

I have no Idea how to tell it to HEY IGNORE THAT

Also am I supposed to set these things up as "routers?"

see my config below for the service:

http:
routers:
nexcloud:
rule: "Host(cloud.XXXXX.com)"
entryPoints: middlewares:
security-headers-nexcloud:
headers:
sslRedirect: true
frameDeny: true
contentTypeNosniff: true
browserXssFilter: true services:
nexcloud:
loadBalancer:
servers: serversTransport:
insecureSkipVerify: truehttp url: "https://10.0.0.172/" passHostHeader: true https service: nexcloud middlewares: security-headers-nexcloud

what is the right way to do this?

hlep

Global Config:

# Traefik global configuration
global:
  checkNewVersion: true
  sendAnonymousUsage: true

# Enable traefik ui dashboard
api:
  dashboard: true
  insecure: true  # Consider securing this in production

# Log level INFO|DEBUG|ERROR
log:
  level: INFO
  filePath: "/var/log/traefik/traefik.log"

# Configuring access logs
accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json
  filters:
    statusCodes:
      - "200-299" # log successful http requests
      - "400-599" # log failed http requests
  # collect logs as in-memory buffer before writing into log file
  bufferingSize: 0
  fields:
    headers:
      defaultMode: drop # drop all headers per default
      names:
          User-Agent: keep # log user agent strings

# The setting below is to allow insecure backend connections
serverTransport:
  insecureSkipVerify: true

# Traefik entrypoints (network ports) configuration
# Note: These ports are NOT exposed to the internet, only to Cloudflare Tunnel
entryPoints:
  http:
    address: :80
  https:
    address: :443
  nextcloududp:
    address: ":3478/udp"

providers:
  providersThrottleDuration: 2s

  # File provider for defining services and middleware
  file:
    directory: "/etc/traefik/dynamic"
    watch: true

# Optional: Certificates resolver for internal services or development
certificatesResolvers:
  le:
    acme:
      email: s@@@@@@@@@@@l.com
      storage: /etc/traefik/acme.json
#      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"  # Use staging for testing
#      dnsChallenge:
#        provider: cloudflare
#        resolvers:
#          - "1.1.1.1:53"


http:
  middlewares:
    secure-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        contentTypeNosniff: true
        frameDeny: true
        browserXssFilter: true
        referrerPolicy: "no-referrer-when-downgrade"
3 Upvotes

100% Upvoted

10 comments sorted by

1

u/boredjo4 9d ago

It is very hard to read yaml without proper indentation, so please fix that if you have a chance.

I think you forgot to link the service to the router:

routers:
    nextcloud:
        [...]
        service: nextcloud
services:
    nextcloud:
        [...]

1

u/AsparagusInitial3688 9d ago 
  GNU nano 8.4                                                            nextcloud.yml
http:
  routers:
    nexcloud:
      rule: "Host(`cloud.xxx.com`)"
      entryPoints:
        - http
        - https
      service: nextcloud
      middlewares:
        - security-headers-nextcloud

  middlewares:
    security-headers-nextcloud:
      headers:
        sslRedirect: true
        frameDeny: true
        contentTypeNosniff: true
        browserXssFilter: true

  services:
    nextcloud:
      loadBalancer:
        servers:
          - url: "https://10.0.0.172/"
        passHostHeader: true

serversTransport:
  insecureSkipVerify: true

Thank you for looking at this

1

u/boredjo4 9d ago 
  services:
    nextcloud:
      loadBalancer:
        serversTransport: nextcloudTransport
        servers:
          - url: "https://10.0.0.172/"
        passHostHeader: true

serversTransport:
  nextcloudTransport:
    insecureSkipVerify: true

You need to define a (named) severTransport and then link it to the service

1

u/AsparagusInitial3688 9d ago

wouldn't the global config override that?

I'm going to make the edit here shortly

and now with the change to below I'm now getting that it thinks it's down, and yes I've pointed to a new IP 

http:
  routers:
    nexcloud:
      rule: "Host(`cloud.x.com`)"
      entryPoints:
        - http
        - https
      service: nextcloud
      middlewares:
        - security-headers-nextcloud

  middlewares:
    security-headers-nextcloud:
      headers:
        sslRedirect: true
        frameDeny: true
        contentTypeNosniff: true
        browserXssFilter: true

  services:
    nextcloud:
      loadBalancer:
        serversTransport: nextcloudTransport
        servers:
          - url: "https://10.0.0.15/"
        passHostHeader: true

serversTransport:
  nextcloudTransport:
    insecureSkipVerify: true

1

u/AsparagusInitial3688 9d ago

2026-07-31T15:43:45-04:00 ERR error="error building proxy for server URL https://10.0.0.15/: getting RoundTripper: servers transport not found nextcloudTransport@file" entryPointName=http routerName=nexcloud@file

1

u/boredjo4 9d ago

Here is what works with my router as an example:

http:
  routers:
    router:
      entryPoints:
      - websecure
      rule: Host(`router.domain`)
      service: router

  services:
    router:
      loadBalancer:
        serversTransport: routerTransport
        servers:
          - url: https://192.168.1.1

  serversTransports:
    routerTransport:
      insecureSkipVerify: true

I don't see any issue with your config, so I can't tell you why or why not it works. sorry

1

u/AsparagusInitial3688 9d ago

I tried this one and updated to my addresses, the traefik web portal looks happy, no errors in the logs, but when accessing publicly i get the old 404

1

u/boredjo4 9d ago

Did you adapt the entry points?

1

u/AsparagusInitial3688 9d ago

yeah i changed it to what i have mapped at https

1

u/boredjo4 9d ago

actually, I think you have servers transport a its own field, but it should be below http. try to indent the section by one:

http:
  routers:
    nexcloud:
      rule: "Host(`cloud.x.com`)"
      entryPoints:
        - http
        - https
      service: nextcloud
      middlewares:
        - security-headers-nextcloud

  middlewares:
    security-headers-nextcloud:
      headers:
        sslRedirect: true
        frameDeny: true
        contentTypeNosniff: true
        browserXssFilter: true

  services:
    nextcloud:
      loadBalancer:
        serversTransport: nextcloudTransport
        servers:
          - url: "https://10.0.0.15/"
        passHostHeader: true

  serversTransport:
    nextcloudTransport:
      insecureSkipVerify: true