Traefik路由规则解析正常但不生效，访问GitLab报500错误求助

问题场景 #

Debian虚拟机部署Traefik（无Docker/K8s），用于路由同物理机下其他虚拟机的服务。Ubuntu虚拟机上的GitLab通过IP访问正常，但域名访问报500内部错误。Traefik日志显示请求走web入口点（80端口）而非websecure（443），即使尝试HTTPS访问。

Traefik访问日志 #

{"ClientAddr":"162.158.137.230:43484","ClientHost":"162.158.137.230","ClientPort":"43484","ClientUsername":"-","DownstreamContentSize":21,"DownstreamStatus":500,"Duration":5572119,"OriginContentSize":21,"OriginDuration":5523512,"OriginStatus":500,"Overhead":48607,"RequestAddr":"gitlab.DOMAIN","RequestContentSize":0,"RequestCount":2392,"RequestHost":"gitlab.DOMAIN","RequestMethod":"GET","RequestPath":"/favicon.ico","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"RouterName":"gitlab@file","ServiceAddr":"192.168.0.5:443","ServiceName":"gitlab@file","ServiceURL":"https://192.168.0.5:443","StartLocal":"2024-11-10T16:38:36.53410902-06:00","StartUTC":"2024-11-10T22:38:36.53410902Z","entryPointName":"web","level":"info","msg":"","request_User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","time":"2024-11-10T16:38:36-06:00"}

配置文件 #

静态配置（traefik.yml） #

global:
  checkNewVersion: true
  sendANonymousUsage: false

providers:
  file:
    directory: /etc/traefik/conf.d/
    watch: true

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

certificatesResolvers:
  cloudflare:
    acme:
      caServer: https://acme-v02.api.letsencrypt.org/directory
      email: "MYEMAIL"
      storage: /etc/traefik/ssl/acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

  letsencrypt:
    acme:
      email: "MYEMAIL"
      storage: /etc/traefik/ssl/acme.json
      tlschallenge: true

api:
  dashboard: true
  insecure: true

log:
  filePath: /var/log/traefik/traefik.log
  format: json
  level: INFO

accessLog:
  filePath: /var/log/traefik/traefik-access.log
  format: json
  filters:
    statusCodes:
      - "200"
      - "400-599"
    retryAttempts: true
    minDuration: "10ms"
  bufferingSize: 0
  fields:
    headers:
      defaultMode: drop
      names:
        User-Agent: keep

动态配置1（catchall规则） #

http:
  routers:
    catchall:
      entryPoints:
        - "web"
        - "websecure"
      rule: "PathPrefix(`/`)"
      service: unavailable
      priority: 1

  services:
    unavailable:
      loadBalancer:
        servers: {}

tls:
  stores:
    default:
      defaultGeneratedCert:
        resolver: cloudflare
        domain:
          main: DOMAIN
          sans:
            - "*.DOMAIN"

动态配置2（GitLab路由） #

http:
  routers:
    gitlabsec:
      rule: Host(`gitlab.DOMAIN`)
      entrypoints:
        - "websecure"
      tls:
        certResolver: cloudflare
        domains:
          - main: "gitlab.DOMAIN"
      service: gitlabsec

    gitlab:
      rule: Host(`gitlab.DOMAIN`)
      service: gitlab

  services:
    gitlabsec:
      loadbalancer:
        servers:
          - url: https://192.168.0.5:443
            scheme: https
        passHostHeader: true

    gitlab:
      loadbalancer:
        servers:
          - url: http://192.168.0.5
            scheme: http
        passHostHeader: true

已知：DOMAIN和*.DOMAIN证书已生成，gitlab.DOMAIN证书未生成，预期Traefik使用泛域名证书。

排查方向与解决方案 #

1. 修复路由入口点匹配问题 #

日志显示请求匹配的是gitlab@file路由（HTTP规则），而非gitlabsec，核心原因是：

• 键名大小写错误：动态配置中gitlabsec的entrypoints是小写，而静态配置中定义的是entryPoints（大写P），Traefik对YAML键名大小写敏感，导致HTTPS路由无法关联到websecure入口点。修正为：

  gitlabsec:
    rule: Host(`gitlab.DOMAIN`)
    entryPoints:
      - "websecure"
  

• 设置路由优先级：给gitlabsec设置更高优先级（如priority: 10），确保HTTPS路由优先匹配，避免和HTTP路由规则冲突。

2. 解决500错误的核心原因 #

日志显示Traefik将HTTP请求转发到GitLab的HTTPS端口，导致协议不匹配或证书验证失败：

• 跳过后端证书验证：如果GitLab使用自签名证书，Traefik默认会验证证书有效性，添加serverTransport配置跳过验证：

  http:
    serverTransports:
      gitlab-transport:
        insecureSkipVerify: true
  
  services:
    gitlabsec:
      loadbalancer:
        servers:
          - url: https://192.168.0.5:443
        passHostHeader: true
      serverTransport: gitlab-transport
  

• 修正GitLab配置：确保GitLab的external_url与域名一致，并信任Traefik的反向代理请求，在gitlab.rb中添加：

  external_url 'https://gitlab.DOMAIN'
  nginx['proxy_set_headers'] = {
    "X-Forwarded-Proto" => "https",
    "X-Forwarded-Ssl" => "on"
  }
  

3. 添加HTTP到HTTPS自动重定向 #

避免用户访问HTTP协议导致的路由错误，在静态配置的web入口点添加重定向规则：

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https

4. 优化泛域名证书使用 #

删除gitlabsec路由中单独的certResolver配置，让Traefik自动匹配默认TLS store中的泛域名证书：

gitlabsec:
  rule: Host(`gitlab.DOMAIN`)
  entryPoints:
    - "websecure"
  tls: {}
  service: gitlabsec

内容的提问来源于stack exchange，提问作者James