Why is my portainer and traefik not public available? - docker-compose

Question

I'm setting up a docker swarm and try to get working traefik reverse and portainer+agent on docker manager. But the container isnt public available.
I'm new to docker and reverse proxys so i dont tried more than the code showing up.
Starting with:
docker stack deploy -c stack.yml stack0
stack.yml
version: "3.3"
services:
traefik:
image: traefik
command: --docker.swarmmode
networks:
- traefik-net
ports:
- "80:80"
- "443:443"
- "8080:8080"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./traefikdata:/etc/traefik
deploy:
placement:
constraints: [node.role==manager]
portainer-agent:
image: portainer/agent
environment:
AGENT_CLISTER_ADDR: tasks.agent
AGENT_PORT: 9001
LOG_LEVEL: debug
ports:
- target: 9001
published: 9001
protocol: tcp
mode: host
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /var/lib/docker/volumes:/var/lib/docker/volumes
networks:
- portainer-agent_network
- traefik-net
deploy:
mode: global
placement:
constraints: [node.platform.os == linux]
portainer:
image: portainer/portainer
command: -H tcp://tasks.agent:9001 --tlsskipverify
volumes:
- "/var/run/docker.sock:/var/run/docker.sock"
- "./portainerdata:/data"
networks:
- portainer-agent_network
- traefik-net
deploy:
mode: replicated
replicas: 1
placement:
constraints: [node.role == manager]
labels:
- "traefik.enable=true"
- "traefik.port=9000"
- "traefik.docker.network=stack0_traefik-net"
- "traefik.frontend.rule=Host:portainer.intern.domain.tld"
networks:
traefik-net:
portainer-agent_network:
driver: overlay
attachable: true
traefikdata/traefik.toml
logLevel = "INFO"
defaultEntryPoints = ["http", "https"]
[web]
address = ":8080"
[docker]
domain = "traefik.intern.domain.tld"
watch = true
exposedbydefault = false
# Force HTTPS
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
# Let's encrypt configuration
[acme]
email="network#techgods.biz"
storage="/etc/traefik/acme/acme.json"
entryPoint="https"
acmeLogging=true
OnHostRule=true
[acme.httpChallenge]
entryPoint = "http"
I expect a running Traefik reverse Proxy, UI reachable over traefik.intern.domain.tld and portainer reachable over portainer.intern.domain.tld

Answer 1

For complete explicitness, I would also put the entryPoints definition:
- "traefik.frontend.entryPoints=https"
Are you positive that this part is correct?
- "traefik.docker.network=stack0_traefik-net"
It doesn't seem to align with your network definitions:
networks:
traefik-net:
portainer-agent_network:
driver: overlay
attachable: true
I'd highly recommend getting this working without the network definitions and then later adding these one at a time.

Answer 2

After hours of trying to revive my stack.yml i started from beginning, read a bit more of documentation and found much helpful stackoverflow posts.
At the end, I'm actually having this:
version: "3"
services:
traefik:
image: traefik:latest
command: --web --docker --docker.swarmmode --docker.watch --docker.domain=intern.domain.tld --logLevel=DEBUG
deploy:
placement:
constraints: [node.role==manager]
restart_policy:
condition: on-failure
labels:
- "traefik.port=8080"
- "traefik.docker.network=proxy"
- "traefik.frontend.rule=Host:traefik.intern.domain.tld"
ports:
- "80:80"
- "5003:8080"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /dev/null:/traefik.toml
networks:
- proxy
portainer:
image: portainer/portainer:latest
command: --no-auth -H unix:///var/run/docker.sock
deploy:
placement:
constraints: [node.role == manager]
labels:
- "traefik.portainer.port=9000"
- "traefik.docker.network=proxy"
- "traefik.frontend.rule=Host:portainer.intern.domain.tld"
ports:
- "5001:9000"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
networks:
- proxy
networks:
proxy:
Now i would need to get the portainer agent working. I'll work on it. On the first view portainer and traefik reachable on the right ports. SSL not yet, but for this my questions below.
Actually portainer.intern.domain.tld:5001 and traefik.intern.domain.tld:5001 both still portainer, but traefik.intern.domain.tld:5001 should not be reachable - just :5003 with traefik - Also the other way round.
In the documentation, I've read that for cluster operation, kv storage is needed to use acme certificates across multiple hosts. Nevertheless, I found configurations with the acme.json configuration in the network (for the swarm operation). Is kv storages obligatory or not?
I would really appreciate if their is a basic auth for the first in front of portainer and traefik - later wanna edit this to certificates. I know a bit about configuration in the traefik.toml - but is it the right way, if i done anything else over the compose file?
Same for SSL - i know a bit about configuration over traefik.toml, but is it the right way? What about storing all this in the compose file?
thank u in advance.