Traefik V2 (armv6) - Reverse Proxy with SSL termination - without Docker - ssl

Question

I have a raspberry pi that I want to use for SSL termination and as a reverse proxy for other pis running services.
Why? I was able to get HTTPS using my Synology NAS but ACME recently got upgraded in Let's Encrypt and my NAS version is too old. I also want to use Traefik as a learning experience.
I have managed to successfully install Traefik V2 -outside of Docker- and it is running fine and redirecting to the appropriate back-end servers. However, SSL doesn't work. Not sure what I might have configured incorrectly. I appreciate anyone's help.
I see the following error on the web interface, but I can't find any log files being created in the specified path.
After burning my eyes reading their docs and anything I could find online, I have the following 'traefik.yaml' file:
#################################
# Traefik V2 Static Configuration
#################################
# Global Configurations
global:
# Check for Update
checkNewVersion: true
# Configure the transport between Traefik and your servers
serversTransport:
# Skip the check of server certificates
insecureSkipVerify: true
# How manny connections per server
maxIdleConnsPerHost: 42
# Define timeouts
forwardingTimeouts:
dialTimeout: 42
responseHeaderTimeout: 42
idleConnTimeout: 42
# Configure the network entrypoints into Traefik V2. Which port will receive packets and if TCP/UDP
entryPoints:
# HTTP Entry Point
web:
# Listen on TCP port 80 (80/tcp)
address: ":80"
# redirect http to https
http:
redirections:
entryPoint:
# Where to redirect
to: web-secure
# Scheme to use
scheme: https
# Make it always happen
permanent: true
# Specify the timeouts for the transports
transport:
# Controls the behavior during the shutdown phase
lifeCycle:
requestAcceptGraceTimeout: 42
graceTimeOut: 42
# Timeouts for incoming requests to Traefik V2 instance. No effect on UDP.
respondingTimeouts:
readTimeout: 42
writeTimeout: 42
idleTimeout: 42
# Define how the Proxy Protocol should behave and what to trust.
proxyProtocol:
# Specify IPs for secure mode
trustedIPs:
- 10.0.0.1
- 127.0.0.1
forwardedHeaders:
# Specify IPs for secure mode
trustedIPs:
- 10.0.0.1
- 127.0.0.1
# HTTPS Entry Point
web-secure:
# Listen on TCP port 80 (80/tcp)
address: ":443"
# Define TLS with Let's Encrypt for all
http:
tls:
certResolver: letsencrypt
# Specify the timeouts for the transports
transport:
# Controls the behavior during the shutdown phase
lifeCycle:
requestAcceptGraceTimeout: 42
graceTimeOut: 42
# Timeouts for incoming requests to Traefik V2 instance. No effect on UDP.
respondingTimeouts:
readTimeout: 42
writeTimeout: 42
idleTimeout: 42
# Define how the Proxy Protocol should behave and what to trust.
proxyProtocol:
# Specify IPs for secure mode
trustedIPs:
- 10.0.0.1
- 127.0.0.1
forwardedHeaders:
# Specify IPs for secure mode
trustedIPs:
- 10.0.0.1
- 127.0.0.1
# Configure the providers
providers:
providersThrottleDuration: 42
# If using a dynamic file
file:
filename: "/etc/traefik/traefik-dynamic.yaml"
watch: true
debugLogGeneratedTemplate: true
rest:
insecure: true
# Traefik's Dashboard located in http://<ip>/dashboard/ (last / necessary)
api:
# Enable the dashboard
dashboard: true
# Location of Log files
log:
# Logging levels are: DEBUG, PANIC, FATAL, ERROR, WARN, INFO
level: DEBUG
filePath: "/etc/traefik/traefik.log"
# SSL Certificates
certificatesResolvers:
# Use Let's Encrypt for SSL Certificates
letsencrypt:
# Enable ACME (Let's Encrypt automatic SSL)
acme:
# E-mail used for registration
email: <my e-mail>
# Leave commented for PROD servers uncomment for Non Prod
#caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
# File or key used for certificates storage.
storage: acme.json
# Optional
#keyType: RSA4096
# Use HTTP-01 ACME challenge
httpChallenge:
entryPoint: web
And the following 'traefik-dynamic.yaml' file:
#################################
# Traefik V2 Dynamic Configuration
#################################
# Definition on how to handle HTTP requests
http:
# Define the routers
routers:
# Map Traefik Dashboard requests to the Service
Traefik:
middlewares:
- BasicAuth
rule: "Host(`traefik.subdomain.dns1.us`)"
service: api#internal
tls:
certResolver: letsencrypt
# Map PLEX to the Server
# No EntryPoints defined so that it listens in all of them
PLEX:
rule: "Host(`plex.subdomain.dns1.us`)"
service: PLEX
tls:
certResolver: letsencrypt
# Define the middlewares
middlewares:
# Basic auth for the dashboard
BasicAuth:
basicAuth:
# Specify user and password (generator: https://www.web2generators.com/apache-tools/htpasswd-generator)
users:
- "<user>:<password>"
# Define the services
services:
#PLEX Service
PLEX:
loadBalancer:
# Backend URLs
servers:
- url: "http://10.0.0.21:32400"
# Enable sticky sessions
sticky:
cookie: {}
# Pass the client Host header to the server
passHostHeader: true

Answer 1

Issue was the /etc/traefik/acme.json file.
I removed it and restarted the Raspberry Pi. Traefik re-created the file and no errors showed up.