main error in traefik level=debug msg="http: TLS handshake error from 172.19.0.1:59130: remote error: tls: unknown certificate" and docker-traefik-1 | time="2022-03-17T16:14:51Z" level=debug msg="No default certificate, generating one" tlsStoreName=default

the problem seems to come from the fact traefik do not load the dynamic conf :

docker-traefik-1  | time="2022-03-17T15:54:23Z" level=debug msg="Configuration received from provider file: {\"http\":{},\"tcp\":{},\"udp\":{},\"tls\":{}}" providerName=file

Config Files

static conf in traefik.yml

services:
  traefik:
    image: traefik:v2.6
    command:
      - --log.level=DEBUG
      #- --providers.file.filename=/cert.yml
      - --providers.file.directory=/dynamic_conf/
      - --providers.file.watch=true
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --entrypoints.web.address=:80
      - --entrypoints.web-secure.address=:443

    restart: always
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
      - "8040:8040"
    networks:
      - federation
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./ssl/test.key:/ssl/test.key
      - ./ssl/test.crt:/ssl/test.crt
      # - ./ssl/:/ssl/
      - ./dynamic_conf/cert.yml:/dynamic_conf/cert.yml:ro
      - ./cert.yml:/cert.yml
    # labels:
    # - "traefik.enable=true"
    # - "traefik.http.routers.traefik=true"

networks:
  federation:
    name: federation

dynamic conf :

tls:
  #  certificates:
  #    certFile: /ssl/test.crt
  #    keyFile: /ssl/test.key
  #    stores:
  #      - default
  certificates:
    - certFile: /ssl/test.crt
      keyFile: /ssl/test.key

Nginx traefik V2 labels :

      - "traefik.http.routers.${COMPOSE_PROJECT_NAME}.rule=Host(`${COMPOSE_PROJECT_NAME}.funkwhale.localhost`)"
      - "traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls=true"
      - "traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls.domains[0].main=${COMPOSE_PROJECT_NAME}.funkwhale.localhost"
      - "traefik.enable=true"
      - "traefik.federation.protocol=http"
      - "traefik.federation.port=80"
      - "traefik.docker.network=federation"

I change a little bit the ssl cert generation but this shouldn't change anything :
./ssl/openssl.con

# cf https://stackoverflow.com/questions/10175812/how-to-create-a-self-signed-certificate-with-openssl/27931596#27931596
# create with openssl req -config openssl.conf -new -x509 -sha256 -newkey rsa:2048 -nodes -keyout test.key -days 365 -out test.crt
# sudo cp test.crt /usr/local/share/ca-certificates/ ; sudo update-ca-certificates # note that the cert need to end with .crt to be picked.
# verify : openssl verify test.crt

[ req ]
default_bits        = 2048
default_keyfile     = server-key.pem
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only

# The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
#   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.
[ subject ]
countryName         = Country Name (2 letter code)
countryName_default     = US

stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = NY

localityName            = Locality Name (eg, city)
localityName_default        = New York

organizationName         = Organization Name (eg, company)
organizationName_default    = Example, LLC

# Use a friendly name here because it's presented to the user. The server's DNS
#   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
#   by both IETF and CA/Browser Forums. If you place a DNS name here, then you
#   must include the DNS name in the SAN too (otherwise, Chrome and others that
#   strictly follow the CA/Browser Baseline Requirements will fail).
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = *funkwhale.localhost

emailAddress            = Email Address
emailAddress_default        = test@example.com

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ x509_ext ]

subjectKeyIdentifier        = hash
authorityKeyIdentifier    = keyid,issuer

# You only need digitalSignature below. *If* you don't allow
#   RSA Key transport (i.e., you use ephemeral cipher suites), then
#   omit keyEncipherment because that's key transport.
basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment, keyCertSign
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
#   CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
#   In either case, you probably only need serverAuth.
# extendedKeyUsage    = serverAuth, clientAuth

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ req_ext ]

subjectKeyIdentifier        = hash

basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
#   CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
#   In either case, you probably only need serverAuth.
# extendedKeyUsage    = serverAuth, clientAuth

[ alternate_names ]

DNS.1       = funkwhale.localhost
DNS.2       = node1.funkwhale.localhost
DNS.3       = node2.funkwhale.localhost
DNS.4       = node3.funkwhale.localhost
DNS.5       = localhost
DNS.6       = 127.0.0.1

# Add these if you need them. But usually you don't want them or
#   need them in production. You may need them for development.
# DNS.5       = localhost
# DNS.6       = localhost.localdomain
# DNS.7       = 127.0.0.1

# IPv6 localhost
# DNS.8     = ::1