Traefik support for navcontainerhelper, the NAV ARM templates for Azure VMs and local environments

Traefik support for navcontainerhelper, the NAV ARM templates for Azure VMs and local environments

1. June 2019

Traefik support for navcontainerhelper, the NAV ARM templates for Azure VMs and local environments

I had recently written about the usage of traefik as reverse proxy for multiple Business Central containers on an Azure VM. While I tried to make that setup quite easy, as always there was room for improvement. With the help of Freddy Kristiansen I therefore implemented two additions to navcontainerhelper and the NAV ARM templates (the technology driving and similar offerings) which Freddy was kind enough to accept.


When you use one of the ARM templates, you now have a switch “use Traefik”. If you enable that and also provide a Let’s encrypt contact email, the VM will automatically be set up with the necessary config files and also run traefik in a container.

The second part is navcontainerhelper which now also has a switch -useTraefik. When that is used, the labels needed for traefik are automatically added when your container is started. You just do the same as always and add -useTraefik, e.g. New-NavContainer -accept_eula -containerName imau -imageName -useTraefik. The output will let you know how to reach your traefik endpoints, e.g. as follows:

Host is Microsoft Windows Server 2019 Datacenter - ltsc2019
Docker Client Version is 18.09.4
Docker Server Version is 18.09.4
Using image
PublicDnsName is
Creating Nav container imau
Nav container imau successfully created
Because of Traefik, the following URLs need to be used when accessing the container from outside your Docker host:
Web Client:
SOAP WebServices:
OData WebServices:
Dev Service:
File downloads:

The details for Azure VMs

I have explained the workings of traefik together with Business Central already in the blog post mentioned above and the mechanism used now is exactly the same. Check the New-NavContainer implementation here and here for the main parts of the actual code, but it should work straight forward. Still, there are a couple of things to note:

Don’t try this at home

Just kidding, of course you can also try this at home, i.e. on premise. It works the same with one exception: In the configuration provided through navcontainerhelper, traefik will try to get an SSL certificate from Let’s Encrypt. That means that your Docker host needs to be accessible from the internet with the same public DNS name and traefik needs to own port 80. If that is the case, you can just do the exact same thing on premise: First call Setup-TraefikContainerForNavContainers once and then call New-NavContainer with -useTraefik every time you need a new container.

If your host is not reachable from the internet with the same name or port 80 can’t be used by traefik, you can use your own certificate (publicly valid or self-signed). The first step also is Setup-TraefikContainerForNavContainers. Assuming that my host is called, the command is something like the following. Note that I am not giving it a valid email address as Let’s Encrypt won’t work anyways.

Setup-TraefikContainerForBCContainers -PublicDnsName -ContactEMailForLetsEncrypt noneed

If you check the logs of the traefik container afterwards, you will see something like this as is to be expected:

2019/05/31 12:46:29 Using high precision timer
time="2019-05-31T12:46:33+02:00" level=error msg="Unable to obtain ACME certificate for domains \"\" : cannot get ACME client acme: error: 400 :: POST :: :: urn:ietf:params:acme:error:invalidEmail :: Error creating new account :: not a valid e-mail address, url: "

I assume that you have a valid certificate called traefik.crt and a key file traefik.key for the public DNS name of your Docker host. To use them, you need to do the following:

With that in place, the traefik endpoints should just work as expected