# Docker, Traefik, LetsEncrypt, ACME Automatic SSL?

**URL:** <https://forum.inductiveautomation.com/t/docker-traefik-letsencrypt-acme-automatic-ssl/52305>\
**Category:** Ignition Early Access\
**Created:** [October 25, 2021, 5:41pm UTC](https://forum.inductiveautomation.com/t/docker-traefik-letsencrypt-acme-automatic-ssl/52305 "2021-10-25T17:41:42Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![kcollins](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcollins/32/19646_2.png) [@kcollins](https://forum.inductiveautomation.com/u/kcollins)\
**Post date:** [October 25, 2021, 9:09pm UTC](https://forum.inductiveautomation.com/t/docker-traefik-letsencrypt-acme-automatic-ssl/52305/2 "2021-10-25T21:09:55Z")

</div>

It looks like you’ve got Traefik standing in front of your containers, handling the TLS termination. From there, you’ve got it piped into the Docker socket and able to observe labels applied to various containers to drive the configuration.

If you’ve got this already working for other containers, then it is probably just a matter of setting up your label configuration for Ignition. It looks like your certificate resolver configured in Traefik is called `letsencrypt`, so I’d think this set of labels should get you close:

```auto
labels:
  - ...
  // "websecure" should match the name of your entrypoint listening on 443 in Traefik.
  - "traefik.http.routers.ignition.entrypoints=websecure"  
  // "letsencrypt" should match the configuration for your ACME resolver in Traefik.
  - "traefik.http.routers.ignition.tls.certresolver=letsencrypt"
  // You need to probably explicitly configure your service port target, so lets point it at 8088 (i.e. standard http behind Traefik's TLS termination)
  - "traefik.http.services.ignition.loadbalancer.server.port=8088"
  // And finally, a rule to match against for the DNS name you want to pipe into this gateway container
  - "traefik.http.routers.ignition.rule=Host(`my-ignition.dev`)"

```

If you’re on 8.1.6+, then you won’t need the path rewrite discussed [here](https://forum.inductiveautomation.com/t/hard-coded-request-for-http-in-designer-launcher-even-if-gateway-set-up-for-https/34027/8).

Hopefully this helps a bit…

---

_[View the full topic](https://forum.inductiveautomation.com/t/docker-traefik-letsencrypt-acme-automatic-ssl/52305)._