Traefik默认证书在docker-compose.yml中不生效，外部动态配置正常如何解决

问题场景 #

我用Docker Compose配置Traefik时遇到一个问题：外部动态配置文件里设置默认证书完全正常，但把相同配置挪到docker-compose.yml里就无法生效。

有效外部动态配置代码 #

tls:
  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/certs/cert.pem
        keyFile: /etc/traefik/certs/key.pem

当前docker-compose.yml相关配置 #

services:
  traefik:
    command:
      - --api.insecure=true
      - --entrypoints.https.address=:443
      - --providers.docker
    image: traefik
    labels:
      - "traefik.http.routers.traefik.entrypoints=https"
      - "traefik.http.routers.traefik.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.tls.stores.default.defaultcertificate.certfile=/etc/traefik/certs/cert.pem"
      - "traefik.tls.stores.default.defaultcertificate.keyfile=/etc/traefik/certs/key.pem"
    ports:
      - "443:443"
    volumes:
      - ./traefik/cert.pem:/etc/traefik/certs/cert.pem
      - ./traefik/key.pem:/etc/traefik/certs/key.pem
      - /var/run/docker.sock:/var/run/docker.sock

解决方法 #

问题核心在于：全局TLS存储配置不能通过容器的labels设置，这类Traefik核心全局参数必须放到command命令行参数中，或者通过挂载静态/动态配置文件定义（你之前成功的方式）。

修改后的docker-compose.yml相关部分：

services:
  traefik:
    command:
      - --api.insecure=true
      - --entrypoints.https.address=:443
      - --providers.docker
      # 将TLS默认证书配置移到command参数中
      - --tls.stores.default.defaultCertificate.certFile=/etc/traefik/certs/cert.pem
      - --tls.stores.default.defaultCertificate.keyFile=/etc/traefik/certs/key.pem
    image: traefik
    labels:
      - "traefik.http.routers.traefik.entrypoints=https"
      - "traefik.http.routers.traefik.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls=true"
      # 删除labels中无效的TLS存储配置
    ports:
      - "443:443"
    volumes:
      - ./traefik/cert.pem:/etc/traefik/certs/cert.pem
      - ./traefik/key.pem:/etc/traefik/certs/key.pem
      - /var/run/docker.sock:/var/run/docker.sock

原因说明 #

Traefik的labels设计用途是配置路由、服务、中间件这类和具体服务绑定的规则，而全局TLS存储属于Traefik的核心全局设置，只能通过命令行参数或静态配置文件定义，这也是你之前外部动态配置能生效、但labels配置失效的原因。

内容的提问来源于stack exchange，提问作者Marius