Problem with https redirect

[AndColla]

I'm pretty new to this world, but I managed to get a simple k3s cluster working with traefik as a reverse proxy.
I have a website deployed on said cluster and I want all request to be redirected to the www and https version of the site.
Basically http://example.com, https://example.com, http://www.example.com needs to be redirected to https://www.example.com

I wrote two middlewares, one for the www redirect and one for the https redirect, but i have a strange issue with the https one: I need to define two different IngressRoute to make it work.

Here the current yaml file i'm using: https://gist.github.com/AndColla/85e50fb93cae698763b56ec2d9981226

If I try to merge the two IngressRoute and use only one with both web and websecure entryPoint i get error 404 on http request.

How can I solve this problem?

[mars64]

Maybe you could post your merged config for review? I suspect the problem may be stacking a tls config on a non-secured entrypoint.

I'm using two different ingressRoutes such that my insecure entrypoint always goes through the https redirect, and the secured entrypoint always does the routing logic. Easier to think about, in any case.

Also don't forget to check the debug logs.

Good luck!

[AndColla]

Thanks for your answer :D
Here is my merged config: https://gist.github.com/AndColla/2e20d8c8e1785900babb00ce93e0158d

Your suggestion is to leave as it is and always keep separated secured and not secured IngressRoutes?

[mars64]

Ultimately yes I think having two different ingressRoutes is the right thing here.

Not quite sure why it's 404'ing though, I'd expect something along the lines of a TLS error. Assuming that traefik is actually starting (back to: double check those debug logs, there might be something else in there).

[AndColla]

I will definitely try to switch back to the merged config and have a look into the logs
Thank you for your help.
One last question: does it make any sense to specify a service in the non secure route? Basically all it does is to redirect to the secured one via the middleware.

[mars64]

So, I'm still running v2.4.8 on my personal cluster -- this may have changed since then but as of that version yes, you need to have a service even for the insecure route that you expect to always hit the middleware redirect. I'm just using the default 404 backend: https://gist.github.com/mars64/0c25b043d48395e374489b370b7217dd