feat: expose letsencrypt-server property for traefik plugin

docs/networking/proxies/traefik.md

@@ -21,7 +21,7 @@ The Traefik plugin has specific rules for routing requests:
 - While Traefik will respect labels associated with other containers, only `web` containers have Traefik labels injected by the plugin.
 - Only `http:80` and `https:443` port mappings are supported.
 - If no `http:80` mapping is found, the first `http` port mapping is used for http requests.
-- If no `https:443` mapping is found, the first `https` port mapping is used for http requests.
+- If no `https:443` mapping is found, the first `https` port mapping is used for https requests.
 - If no `https` mapping is found, the container port from `http:80` will be used for https requests.
 - Requests are routed as soon as the container is running and passing healthchecks.
 
@@ -108,7 +108,11 @@ dokku traefik:set --global log-level DEBUG
 
 After modifying,  the Traefik container will need to be restarted.
 
-### Enabling letsencrypt integration
+### SSL Configuration
+
+The traefik plugin only supports automatic ssl certificates from it's letsencrypt integration. Managed certificates provided by the `certs` plugin are ignored.
+
+#### Enabling letsencrypt integration
 
 By default, letsencrypt is disabled and https port mappings are ignored. To enable, set the `letsencrypt-email` property with the `--global` flag:
 
@@ -118,6 +122,16 @@ dokku traefik:set --global letsencrypt-email automated@dokku.sh
 
 After enabling, apps will need to be rebuilt and the Traefik container will need to be restarted. All http requests will then be redirected to https.
 
+#### Customizing the letsencrypt server
+
+The letsencrypt integration is set to the production letsencrypt server by default. To change this, set the `letsencrypt-server` property with the `--global` flag:
+
+```shell
+dokku traefik:set --global letsencrypt-server https://acme-staging-v02.api.letsencrypt.org/directory
+```
+
+After enabling, the Traefik container will need to be restarted and apps will need to be rebuilt to retrieve certificates from the new server.
+
 ### API Access
 
 Traefik exposes an API and Dashboard, which Dokku disables by default for security reasons. It can be exposed and customized as described below.
@@ -184,6 +198,7 @@ dokku traefik:report
        Traefik dashboard enabled:     false
        Traefik image:                 traefik:v2.8
        Traefik letsencrypt email:
+       Traefik letsencrypt server:
        Traefik log level:             ERROR
 =====> python-app traefik information
        Traefik api enabled:           false
@@ -193,6 +208,7 @@ dokku traefik:report
        Traefik dashboard enabled:     false
        Traefik image:                 traefik:v2.8
        Traefik letsencrypt email:
+       Traefik letsencrypt server:
        Traefik log level:             ERROR
 =====> ruby-app traefik information
        Traefik api enabled:           false
@@ -202,6 +218,7 @@ dokku traefik:report
        Traefik dashboard enabled:     false
        Traefik image:                 traefik:v2.8
        Traefik letsencrypt email:
+       Traefik letsencrypt server:
        Traefik log level:             ERROR
 ```
 
@@ -220,6 +237,7 @@ dokku traefik:report node-js-app
        Traefik dashboard enabled:     false
        Traefik image:                 traefik:v2.8
        Traefik letsencrypt email:
+       Traefik letsencrypt server:
        Traefik log level:             ERROR
 ```
 

plugins/traefik-vhosts/command-functions

@@ -42,6 +42,7 @@ cmd-traefik-report-single() {
     "--traefik-dashboard-enabled: $(fn-traefik-dashboard-enabled)"
     "--traefik-image: $(fn-traefik-image)"
     "--traefik-letsencrypt-email: $(fn-traefik-letsencrypt-email)"
+    "--traefik-letsencrypt-server: $(fn-traefik-letsencrypt-server)"
     "--traefik-log-level: $(fn-traefik-log-level)"
   )
 

plugins/traefik-vhosts/internal-functions

@@ -49,6 +49,7 @@ fn-traefik-template-compose-file() {
   TRAEFIK_DATA_DIR="${DOKKU_LIB_ROOT}/data/traefik"
   TRAEFIK_IMAGE="$(fn-traefik-image)"
   TRAEFIK_LETSENCRYPT_EMAIL="$(fn-traefik-letsencrypt-email)"
+  TRAEFIK_LETSENCRYPT_SERVER="$(fn-traefik-letsencrypt-server)"
   TRAEFIK_LOG_LEVEL="$(fn-traefik-log-level)")
 
   sigil -f "$COMPOSE_TEMPLATE" "${SIGIL_PARAMS[@]}" | cat -s >"$OUTPUT_PATH"
@@ -82,6 +83,10 @@ fn-traefik-letsencrypt-email() {
   fn-plugin-property-get-default "traefik" "--global" "letsencrypt-email" ""
 }
 
+fn-traefik-letsencrypt-server() {
+  fn-plugin-property-get-default "traefik" "--global" "letsencrypt-server" "https://acme-v02.api.letsencrypt.org/directory"
+}
+
 fn-traefik-log-level() {
   local log_level
   log_level="$(fn-plugin-property-get-default "traefik" "--global" "log-level" "ERROR")"

plugins/traefik-vhosts/templates/compose.yml.sigil

@@ -17,7 +17,7 @@ services:
       - --log.format=json
 
       {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
-      - --certificatesresolvers.leresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
+      - --certificatesresolvers.leresolver.acme.caserver={{ $.TRAEFIK_LETSENCRYPT_SERVER }}"
       - --certificatesresolvers.leresolver.acme.email={{ $.TRAEFIK_LETSENCRYPT_EMAIL }}
       - --certificatesresolvers.leresolver.acme.storage=/acme.json
       - --certificatesresolvers.leresolver.acme.tlschallenge=true