www.planetonyx.net behind Traefik (VPS)

0) Mental Model

For https://www.planetonyx.net to work, all of this must line up:

• Public DNS resolves www.planetonyx.net to the VPS IP (directly or via CNAME).
• Traefik listens on TCP 80 and 443 and is reachable from the internet.
• Traefik sees the container via the Docker provider (traefik.enable=true).
• The app container is attached to the same Docker network Traefik uses for upstream connections.
• Router labels match Traefik's real entryPoint names and certResolver names.
• The router rule matches the Host header: Host(`www.planetonyx.net`).

If one of these is wrong you will typically see: Traefik 404 (router not matched/loaded), TLS errors (resolver mismatch), or timeouts/502 (network/upstream mismatch).

1) DNS (Public)

Current pattern:

• www.planetonyx.net is a CNAME to vps.planetonyx.net
• vps.planetonyx.net has an A record with the VPS public IP

Quick check (public resolver):

dig +short CNAME www.planetonyx.net @1.1.1.1
dig +short A vps.planetonyx.net @1.1.1.1

2) Traefik Static Config (VPS)

Traefik has static config (entryPoints, providers, resolvers) and dynamic config (routers, services, middlewares). Your static config uses entryPoints named http/https and a cert resolver named cloudflare.

entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entrypoint:
          to: https
          scheme: https
  https:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    filename: /config.yaml

certificatesResolvers:
  cloudflare:
    acme:
      storage: acme.json
      dnsChallenge:
        provider: cloudflare

The key switch: with exposedByDefault: false you must label containers explicitly, or Traefik will ignore them.

3) Docker Networking Requirement

Traefik must be able to connect to the container IP. The usual pattern is an external network shared by Traefik and all routed apps. In this system the network is named proxy.

# find Traefik networks
docker inspect traefik --format '{{json .NetworkSettings.Networks}}' | jq -r 'keys[]'

# create network if missing
docker network create proxy

4) Working Compose Labels for www.planetonyx.net

This is the minimal working shape (aligned to your Traefik naming):

services:
  about-site:
    build: .
    restart: unless-stopped
    networks: [proxy]
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"

      # HTTPS
      - "traefik.http.routers.www-planetonyx-net.rule=Host(`www.planetonyx.net`)"
      - "traefik.http.routers.www-planetonyx-net.entrypoints=https"
      - "traefik.http.routers.www-planetonyx-net.tls=true"
      - "traefik.http.routers.www-planetonyx-net.tls.certresolver=cloudflare"
      - "traefik.http.services.www-planetonyx-net.loadbalancer.server.port=80"

      # Optional explicit HTTP router for redirect
      - "traefik.http.routers.www-planetonyx-net-http.rule=Host(`www.planetonyx.net`)"
      - "traefik.http.routers.www-planetonyx-net-http.entrypoints=http"
      - "traefik.http.routers.www-planetonyx-net-http.middlewares=www-planetonyx-net-redirect"
      - "traefik.http.middlewares.www-planetonyx-net-redirect.redirectscheme.scheme=https"

networks:
  proxy:
    external: true
    name: proxy

5) Why Traefik Returned 404 Before

The earlier configuration mismatched your real Traefik setup:

• Used entryPoints web/websecure but Traefik has http/https.
• Used certResolver letsencrypt but Traefik resolver is cloudflare.
• Referenced external network traefik but the actual network is proxy.

Any one of these is enough for Traefik to fall back to its default handler and respond with 404.

6) Debug Checklist (Fast)

A) Confirm router labels exist

docker inspect about-site-about-site-1 --format '{{json .Config.Labels}}' \
  | jq -r 'keys[]' | sort

B) Confirm Traefik sees requests for this host

docker exec traefik sh -lc \
  'tail -n 200 /var/log/traefik/access.log | grep -F "\"RequestHost\":\"www.planetonyx.net\"" | tail -n 20'

C) Bypass public DNS and test routing locally

curl -k -o /dev/null -w 'code=%{http_code}\n' https://127.0.0.1/ \
  -H 'Host: www.planetonyx.net'

D) Check public DNS points to the VPS

dig +short CNAME www.planetonyx.net @1.1.1.1
dig +short A www.planetonyx.net @1.1.1.1