404 using wildcard and cloudflare tunnel poinitng to traefik

[alamadorm]

To Reproduce

1. Install cloudflared direcly in the server
2. Add a tunnel pointing to localhost:80 and localhost:443 with a wildcard in both cases
3. Add CNAME dns with a wildcard pointing to the cf tunnel
4. Add a domain to any application in dokploy with a subdomain, like https://n8n.alamador.com (pointing to the right port of the container)
5. Access to the domain (traefik is going to return a 404)

Current vs. Expected behavior

Current
Traefik is returning 404, only when accessing from domain name, not with domains from traefik

Expected
It should be able to serve the applications configured with an external domain

Provide environment information

Operating System:
Ubuntu 24.04.1 LTS (GNU/Linux 6.8.0-84-generic x86_64)

Dokploy version: v0.25.3
VPS Provider: My own machine in my local network.

What Applications/services:
Any application that exposes a domain with traefik

Which area(s) are affected? (Select all that apply)

Traefik

Are you deploying the applications where Dokploy is installed or on a remote server?

Same server where Dokploy is installed

Additional context

I'm running it on my local network in a mini server.

Will you send a PR to fix it?

No

[djsisson]

@alamadorm if you want to use https in a tunnel you need to add the origin domain to the tunnel entry and either add the cf origin cert to traefik or add a dns challenge, otherwise you will get a 404, if you are using strict mode, since the handshake from the tunnel to traefik will not be a valid ca cert.

Also be aware that the tunnel is just an ordered pattern match so the first entry that matches is used, named domains should be first and one wildcard at the bottom, do not use two wildcards, 80/443 as only the first one would be used.

[Siumauricio]

I am not an expert on Cloudflare tunnels, so I will transfer this issue to discussions since it is not a dokploy bug.

[HPaulson]

I fixed this issue by editing the traefik.yml config file in the Traefik File System tab:

  docker:
    exposedByDefault: false
    watch: true
#    network: dokploy-network

By default, traefik can only reach containers on the dokploy-network network, which I think is not assigned by default. My containers only had the project-specific network attached to them. Commenting this line allows traefik to read any network with the traefik.enable label.

[alamadorm]

I'll try this.

[alamadorm]

this fixed the issue for me