Merge pull request #8258 from dokku/6423-traefik-challenge-support

Add support for dns-01 challenge mode when using traefik

docs/networking/proxies/traefik.md

@@ -199,6 +199,41 @@ dokku traefik:set --global letsencrypt-server https://acme-staging-v02.api.letse
 
 After enabling, the Traefik container will need to be restarted and apps will need to be rebuilt to retrieve certificates from the new server.
 
+#### Switching to DNS-01 challenge mode
+
+By default, Traefik uses TLS-ALPN-01 challenge for obtaining certificates. To switch to DNS-01 challenge mode (useful for wildcard certificates or when port 443 is not accessible), you need to:
+
+1. Set the challenge mode to `dns`:
+
+```shell
+dokku traefik:set --global challenge-mode dns
+```
+
+2. Set your DNS provider:
+
+```shell
+dokku traefik:set --global dns-provider cloudflare
+```
+
+3. Configure the required environment variables for your DNS provider. Each DNS provider requires specific environment variables. The variable names should be prefixed with `dns-provider-`:
+
+```shell
+dokku traefik:set --global dns-provider-cf_api_email user@example.com
+dokku traefik:set --global dns-provider-cf_api_key your-api-key
+```
+
+The `dns-provider-` prefix will be stripped and the variable name will be uppercased when passed to the Traefik container. For example, `dns-provider-cf_api_email` becomes `CF_API_EMAIL`.
+
+After configuring, the Traefik container will need to be restarted and apps will need to be rebuilt.
+
+Refer to the [Traefik DNS Challenge documentation](https://doc.traefik.io/traefik/https/acme/#dnschallenge) for the list of supported DNS providers and their required environment variables.
+
+To switch back to TLS challenge mode:
+
+```shell
+dokku traefik:set --global challenge-mode tls
+```
+
 ### API Access
 
 Traefik exposes an API and Dashboard, which Dokku disables by default for security reasons. It can be exposed and customized as described below.
@@ -264,7 +299,9 @@ dokku traefik:report
        Traefik api vhost:             traefik.dokku.me
        Traefik basic auth password:   password
        Traefik basic auth username:   user
+       Traefik challenge mode:        tls
        Traefik dashboard enabled:     false
+       Traefik dns provider:
        Traefik image:                 traefik:v2.8
        Traefik letsencrypt email:
        Traefik letsencrypt server:
@@ -274,7 +311,9 @@ dokku traefik:report
        Traefik api vhost:             traefik.dokku.me
        Traefik basic auth password:   password
        Traefik basic auth username:   user
+       Traefik challenge mode:        tls
        Traefik dashboard enabled:     false
+       Traefik dns provider:
        Traefik image:                 traefik:v2.8
        Traefik letsencrypt email:
        Traefik letsencrypt server:
@@ -284,7 +323,9 @@ dokku traefik:report
        Traefik api vhost:             traefik.dokku.me
        Traefik basic auth password:   password
        Traefik basic auth username:   user
+       Traefik challenge mode:        tls
        Traefik dashboard enabled:     false
+       Traefik dns provider:
        Traefik image:                 traefik:v2.8
        Traefik letsencrypt email:
        Traefik letsencrypt server:
@@ -303,7 +344,9 @@ dokku traefik:report node-js-app
        Traefik api vhost:             traefik.dokku.me
        Traefik basic auth password:   password
        Traefik basic auth username:   user
+       Traefik challenge mode:        tls
        Traefik dashboard enabled:     false
+       Traefik dns provider:
        Traefik image:                 traefik:v2.8
        Traefik letsencrypt email:
        Traefik letsencrypt server: