Permissions 0600 for acme.json are too open: Traefik ACME storage

ACME Certificate Persistence

Traefik utilizes a JSON file, acme.json, to persist TLS certificates and account keys generated via the ACME protocol. To maintain security, Traefik enforces strict filesystem permissions on this file.

Storage Constraint

On Linux environments, the acme.json file must have permissions set to 600. If the file is too accessible, Traefik may ignore the existing certificates or fail to initialize the ACME provider, potentially leading to repeated certificate requests and CA rate limiting.

When migrating or restoring this file across different environments or container volumes, maintaining these specific permissions is critical for the proxy to recognize the recovered data.

• What is the expected behavior when acme.json is restored with incorrect permissions in a non-root container environment?
• Does Traefik attempt to automatically correct these permissions, or does it permanently ignore the file until a manual chmod is performed?