📋 Prerequisites

  • An active domain on OnlyDNS.
  • A TSIG Key generated in the OnlyDNS Portal or via CLI (onlydns tsig create --algo hmac-sha256).
  • Docker and Docker Compose installed.
1

Configure Traefik Static Configuration

Configure an ACME certificate resolver named onlydns-resolver using provider: rfc2136 inside traefik.yml:

traefik.yml 
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"

certificatesResolvers:
  onlydns-resolver:
    acme:
      email: admin@example.com
      storage: /etc/traefik/acme/acme.json
      dnsChallenge:
        provider: rfc2136
        delayBeforeCheck: 5 # OnlyDNS syncs globally in <1s
2

Docker Compose Configuration

Pass the TSIG credentials to the Traefik container via standard environment variables and mount an acme.json file with chmod 600 permissions:

docker-compose.yml 
version: "3.8"

services:
  traefik:
    image: traefik:v3.1
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    environment:
      # OnlyDNS RFC 2136 Provider Variables
      - RFC2136_NAMESERVER=ns1.onlydns.com:53
      - RFC2136_TSIG_KEY=your-tsig-key-name
      - RFC2136_TSIG_SECRET=YOUR_BASE64_TSIG_SECRET_KEY
      - RFC2136_TSIG_ALGORITHM=hmac-sha256.
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./acme.json:/etc/traefik/acme/acme.json

  # Example backend service requesting a wildcard certificate
  webapp:
    image: nginx:alpine
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.webapp.rule=Host(`example.com`) || Host(`app.example.com`)"
      - "traefik.http.routers.webapp.entrypoints=websecure"
      - "traefik.http.routers.webapp.tls=true"
      - "traefik.http.routers.webapp.tls.certresolver=onlydns-resolver"
      - "traefik.http.routers.webapp.tls.domains[0].main=example.com"
      - "traefik.http.routers.webapp.tls.domains[0].sans=*.example.com"

🔒 Prepare acme.json: Traefik requires acme.json to have strict 0600 permissions before launching: 

touch acme.json && chmod 600 acme.json
💡 Least-Privilege Security Tip: In the OnlyDNS Portal or REST API, restrict this TSIG key to only update the _acme_challenge subdomain so your Traefik proxy cannot modify any other DNS records.
3

Start Traefik & Monitor Logs

Start the stack using Docker Compose and watch Traefik automatically fulfill the ACME challenge: 

docker compose up -d
docker compose logs -f traefik

Message Sent

Thanks for contacting OnlyDNS. We received your message and will follow up shortly.