# Enable ACME (Let's Encrypt): automatic SSL.
acme:

  # Email address used for registration.
  #
  # Required
  #
  email: "test@traefik.io"

  # File or key used for certificates storage.
  #
  # Required
  #
  storage: "acme.json"

  # If true, display debug log messages from the acme client library.
  #
  # Optional
  # Default: false
  #
  # acmeLogging: true

  # If true, override certificates in key-value store when using storeconfig.
  #
  # Optional
  # Default: false
  #
  # overrideCertificates: true

  # Enable certificate generation on routers host rules.
  #
  # Optional
  # Default: false
  #
  # onHostRule: true

  # CA server to use.
  # Uncomment the line to use Let's Encrypt's staging server,
  # leave commented to go to prod.
  #
  # Optional
  # Default: "https://acme-v02.api.letsencrypt.org/directory"
  #
  # caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"

  # KeyType to use.
  #
  # Optional
  # Default: "RSA4096"
  #
  # Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
  #
  # KeyType: RSA4096

  # Use a TLS-ALPN-01 ACME challenge.
  #
  # Optional (but recommended)
  #
  tlsChallenge:

  # Use a HTTP-01 ACME challenge.
  #
  # Optional
  #
  # httpChallenge:

    # EntryPoint to use for the HTTP-01 challenges.
    #
    # Required
    #
    # entryPoint: web

  # Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
  # Note: mandatory for wildcard certificate generation.
  #
  # Optional
  #
  # dnsChallenge:

    # DNS provider used.
    #
    # Required
    #
    # provider: digitalocean

    # By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
    # If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
    # Useful if internal networks block external DNS queries.
    #
    # Optional
    # Default: 0
    #
    # delayBeforeCheck: 0

    # Use following DNS servers to resolve the FQDN authority.
    #
    # Optional
    # Default: empty
    #
    # resolvers
    # - "1.1.1.1:53"
    # - "8.8.8.8:53"

    # Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
    #
    # NOT RECOMMENDED:
    # Increase the risk of reaching Let's Encrypt's rate limits.
    #
    # Optional
    # Default: false
    #
    # disablePropagationCheck: true

  # Domains list.
  # Only domains defined here can generate wildcard certificates.
  # The certificates for these domains are negotiated at traefik startup only.
  #
  # domains:
  # - main: "local1.com"
  #   sans:
  #   - "test1.local1.com"
  #   - "test2.local1.com"
  # - main: "local2.com"
  # - main: "*.local3.com"
  #   sans:
  #   - "local3.com"
  #   - "test1.test1.local3.com"
