feat: add http challenge routing

2026-06-30 10:09:35 +02:00
parent b5beb27623
commit f3759e76ea
11 changed files with 78 additions and 9 deletions
@@ -5,6 +5,7 @@ Docker Compose deployment for Traefik used as a TCP load balancer with TLS passt
 ## What it does

 - publishes `443/tcp` on the Docker host;
+- publishes `80/tcp` on the Docker host for HTTP-01 certificate challenges;
 - forwards TCP TLS traffic to backend IP addresses and ports;
 - leaves SSL certificates and private keys on the backends;
 - stores Traefik configuration in the host `./config` directory;
@@ -32,6 +33,16 @@ tcp:

 `HostSNI(...)` matches the hostname sent by the client during the TLS handshake. If a backend listens on the Docker host itself, use `host.docker.internal:PORT`.

+HTTP-01 certificate challenges use normal HTTP routing on port `80`, not SNI. The included example forwards:
+
+```text
+lab.younerd.org/.well-known/acme-challenge/* -> host.docker.internal:8080
+azionelab.org/.well-known/acme-challenge/* -> host.docker.internal:9080
+www.azionelab.org/.well-known/acme-challenge/* -> host.docker.internal:9080
+```
+
+Adjust `8080` and `9080` to the local ports where the Certbot challenge responder or webroot service is listening.
+
 ## Run

 Validate the Compose file: