{"action":"created","issue":{"url":"https://api.github.com/repos/containous/traefik/issues/3174","repository_url":"https://api.github.com/repos/containous/traefik","labels_url":"https://api.github.com/repos/containous/traefik/issues/3174/labels{/name}","comments_url":"https://api.github.com/repos/containous/traefik/issues/3174/comments","events_url":"https://api.github.com/repos/containous/traefik/issues/3174/events","html_url":"https://github.com/containous/traefik/issues/3174","id":313257790,"number":3174,"title":"Traefik deployed in swarm but using host port would lead to significant loss of performance due to ACME at least?","user":{"login":"nsteinmetz","id":33180,"avatar_url":"https://avatars1.githubusercontent.com/u/33180?v=4","gravatar_id":"","url":"https://api.github.com/users/nsteinmetz","html_url":"https://github.com/nsteinmetz","followers_url":"https://api.github.com/users/nsteinmetz/followers","following_url":"https://api.github.com/users/nsteinmetz/following{/other_user}","gists_url":"https://api.github.com/users/nsteinmetz/gists{/gist_id}","starred_url":"https://api.github.com/users/nsteinmetz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nsteinmetz/subscriptions","organizations_url":"https://api.github.com/users/nsteinmetz/orgs","repos_url":"https://api.github.com/users/nsteinmetz/repos","events_url":"https://api.github.com/users/nsteinmetz/events{/privacy}","received_events_url":"https://api.github.com/users/nsteinmetz/received_events","type":"User","site_admin":false},"labels":[{"id":259872491,"url":"https://api.github.com/repos/containous/traefik/labels/kind/question","name":"kind/question","color":"cc317c","default":false},{"id":407670336,"url":"https://api.github.com/repos/containous/traefik/labels/status/0-needs-triage","name":"status/0-needs-triage","color":"EEEEEE","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-04-11T10:08:52Z","updated_at":"2018-04-13T16:43:28Z","closed_at":null,"author_association":"NONE","body":"### Do you want to request a *feature* or report a *bug*?\r\n\r\nSeems a bug - asked yesterday on slack.\r\n\r\n### What did you do?\r\n\r\nI have a 2 nodes swarm cluster, based on docker 17.12.1-ce on ubuntu 16.04.\r\n\r\nI use Traefik 1.5.4, deployed within the swarm cluster. So far it worked well but for the app deployed in the cluster, I need to have the public ip to enable/disable a debug mode on app side. So I had to change port configuration to be at host level and not trough ingress.\r\n\r\nMy traefik compose file: \r\n\r\n``` yaml\r\nversion: '3.4'\r\nservices:\r\n  traefik:\r\n    image: traefik:1.5.4\r\n    deploy:\r\n      placement:\r\n        constraints:\r\n          - node.role == manager\r\n    ports:\r\n#      - \"80:80\"\r\n#      - \"443:443\"\r\n      - target: 80\r\n        published: 80\r\n        protocol: tcp\r\n        mode: host\r\n      - target: 443\r\n        published: 443\r\n        protocol: tcp\r\n        mode: host\r\n    volumes:\r\n      - type: bind\r\n        source: /var/run/docker.sock\r\n        target: /var/run/docker.sock\r\n      - type: bind\r\n        source: /opt/traefik/conf/traefik.toml\r\n        target: /traefik.toml\r\n      - type: bind\r\n        source: /opt/traefik/acme/acme.json\r\n        target: /acme.json\r\n    networks:\r\n      - traefik-net\r\nnetworks:\r\n  traefik-net:\r\n    driver: overlay\r\n    attachable: true\r\n```\r\n\r\nMy traefik.toml file\r\n\r\n```toml\r\ndefaultEntryPoints = [\"http\", \"https\"]\r\n\r\nlogLevel = \"INFO\"\r\n\r\n# Disable certs validation as traefik will use IP to connect containres instead of hostnames, which will never validate.\r\nInsecureSkipVerify = true\r\n\r\n[traefikLog]\r\n  filePath = \"/traefik.log\"\r\n  format = \"json\"\r\n\r\n[accessLog]\r\nfilePath = \"/access.log\"\r\n\r\n[entryPoints]\r\n  [entryPoints.http]\r\n  address = \":80\"\r\n  compress = true\r\n  [entryPoints.https]\r\n  address = \":443\"\r\n    [entryPoints.https.tls]\r\n  [entryPoints.api]\r\n  address = \"127.0.0.1:8080\"\r\n    [entryPoints.api.auth.basic]\r\n    users = [\r\n      \"xxx:xxx\"\r\n    ]\r\n\r\n[acme]\r\nemail = \"sysadmin@xxx.com\"\r\nstorage = \"acme.json\"\r\nentryPoint = \"https\"\r\nonHostRule = true\r\n[acme.httpChallenge]\r\n  entryPoint = \"http\"\r\n\r\n[api]\r\nentryPoint = \"api\"\r\ndashboard = true\r\ndebug = false\r\n\r\n[docker]\r\nendpoint = \"unix:///var/run/docker.sock\"\r\ndomain = \"traefik\"\r\nwatch = true\r\nexposedbydefault = true\r\nswarmmode = true\r\n\r\n[file]\r\n  [backends]\r\n    [backends.backend1]\r\n      [backends.backend1.servers.server0]\r\n      url = \"http://127.0.0.1:8080\"\r\n\r\n  [frontends]\r\n    [frontends.frontend1]\r\n    backend = \"backend1\"\r\n      [frontends.frontend1.routes.test_0]\r\n      rule = \"Host:traefik.xxx.com\"\r\n      [frontends.frontend1.redirect]\r\n      entryPoint = \"https\"\r\n```\r\n\r\n### What did you expect to see?\r\n\r\nWith ingress mode:\r\n\r\n```\r\n10.255.0.2 - - [10/Apr/2018:15:12:12 +0000] \"GET / HTTP/2.0\" 200 20088 - \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\" 1 \"Host-sample-recette-xxx-com-0\" \"https://10.0.2.19:443\" 208ms\r\n```\r\n\r\n208ms is fine\r\n\r\n### What did you see instead?\r\n\r\n\r\nWith host mode:\r\n\r\n```\r\nxxx.xxx.xxx.xxx - - [10/Apr/2018:15:02:30 +0000] \"GET / HTTP/2.0\" 200 20088 - \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\" 136 \"Host-sample-recette-xxxxx-com-0\" \"https://10.0.2.19:443\" 50145ms\r\n```\r\n50s is not fine.\r\n\r\nreviewing the logs, I would say that it generates certs when on host mode whereas it finds them when on ingress mode. Could it be sufficient to explain the issue or could there be something else ?\r\n\r\n### If applicable, please paste the log output at DEBUG level (`--logLevel=DEBUG` switch)\r\n\r\n```\r\ngrep -i acme traefik.log.debug\r\n\"level\":\"debug\",\"msg\":\"No ACME certificate to generate for domains [\\\"traefik.recette.corp.com\\\"].\",\"time\":\"2018-04-11T08:59:21Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No ACME certificate to generate for domains [\\\"traefik.recette.corp.com\\\"].\",\"time\":\"2018-04-11T08:59:21Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No ACME certificate to generate for domains [\\\"portainer.recette.corp.com\\\"].\",\"time\":\"2018-04-11T08:59:21Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No ACME certificate to generate for domains [\\\"sample-backoffice.recette.corp.com\\\"].\",\"time\":\"2018-04-11T08:59:21Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No ACME certificate to generate for domains [\\\"sample-batches.recette.corp.com\\\"].\",\"time\":\"2018-04-11T08:59:21Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No ACME certificate to generate for domains [\\\"sample.recette.corp.com\\\"].\",\"time\":\"2018-04-11T08:59:21Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No ACME certificate to generate for domains [\\\"sample-static.recette.corp.com\\\"].\",\"time\":\"2018-04-11T08:59:21Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No provided certificate found for domains sample.recette.corp.com, get ACME certificate.\",\"time\":\"2018-04-11T08:59:36Z\"}\r\n{\"level\":\"debug\",\"msg\":\"Looking for an existing ACME challenge for sample.recette.corp.com...\",\"time\":\"2018-04-11T08:59:36Z\"}\r\n{\"level\":\"debug\",\"msg\":\"ACME got domain cert sample.recette.corp.com\",\"time\":\"2018-04-11T08:59:36Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No provided certificate found for domains sample-static.recette.corp.com, get ACME certificate.\",\"time\":\"2018-04-11T09:00:27Z\"}\r\n{\"level\":\"debug\",\"msg\":\"Looking for an existing ACME challenge for sample-static.recette.corp.com...\",\"time\":\"2018-04-11T09:00:27Z\"}\r\n{\"level\":\"debug\",\"msg\":\"ACME got domain cert sample-static.recette.corp.com\",\"time\":\"2018-04-11T09:00:27Z\"}\r\n{\"level\":\"debug\",\"msg\":\"No provided certificate found for domains sample-static.recette.corp.com, get ACME certificate.\",\"time\":\"2018-04-11T09:00:27Z\"}\r\n{\"level\":\"debug\",\"msg\":\"Looking for an existing ACME challenge for sample-static.recette.corp.com...\",\"time\":\"2018-04-11T09:00:27Z\"}\r\n{\"level\":\"debug\",\"msg\":\"ACME got domain cert sample-static.recette.corp.com\",\"time\":\"2018-04-11T09:00:27Z\"}\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/containous/traefik/issues/comments/381193742","html_url":"https://github.com/containous/traefik/issues/3174#issuecomment-381193742","issue_url":"https://api.github.com/repos/containous/traefik/issues/3174","id":381193742,"user":{"login":"nsteinmetz","id":33180,"avatar_url":"https://avatars1.githubusercontent.com/u/33180?v=4","gravatar_id":"","url":"https://api.github.com/users/nsteinmetz","html_url":"https://github.com/nsteinmetz","followers_url":"https://api.github.com/users/nsteinmetz/followers","following_url":"https://api.github.com/users/nsteinmetz/following{/other_user}","gists_url":"https://api.github.com/users/nsteinmetz/gists{/gist_id}","starred_url":"https://api.github.com/users/nsteinmetz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nsteinmetz/subscriptions","organizations_url":"https://api.github.com/users/nsteinmetz/orgs","repos_url":"https://api.github.com/users/nsteinmetz/repos","events_url":"https://api.github.com/users/nsteinmetz/events{/privacy}","received_events_url":"https://api.github.com/users/nsteinmetz/received_events","type":"User","site_admin":false},"created_at":"2018-04-13T16:43:28Z","updated_at":"2018-04-13T16:43:28Z","author_association":"NONE","body":"Side question, as I now publish ports on host side, do I still need to define a network for traefik ?\r\n\r\nIn my workflow, I create a network for each test instance and attach traefik to it via `docker service update --network-add <network> <traefik>` which leads to service to be updated."}}
{"actor":{"display_login":"nsteinmetz"}}