使用自签名证书访问在外部服务器上运行的 pgadmin.example.com

Question

从昨天开始，我开始使用 traefik，并尝试使用当前设置解决以下问题：

1. 安装 docker 访问 Ubuntu 服务器
2. traefik.example.com 和 pgadmin.example.com 的自签名证书
3. 使用有效的 SSL 从我的机器解析 URL，例如：https://pgadmin.example.com

以下设置失败，因为它无法解析并且无法访问服务： docker-compose.yml

services:
  traefik:
    container_name: traefik
    image: traefik:latest
    restart: always
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./config/dynamic:/etc/traefik/dynamic:ro
      - ./certs:/etc/traefik/certs:ro
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    networks:
      - dev

networks:
  dev:
    external:
      name: dev

traefik.yml

global:
  checkNewVersion: true
  sendAnonymousUsage: false

log:
  level: DEBUG

entryPoints:
  web:
    address: :80
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true

  websecure:
    address: :443
    http:
      tls: true

api:
  insecure: true

providers:
  docker:
    exposedByDefault: false

  file:
    directory: /etc/traefik/dynamic
    watch: true

dynamic_conf.yml

# Dynamic configuration
# SSL Certs
tls:
  certificates:
    - certFile: /etc/traefik/certs/traefik.example.com.cert.pem
      keyFile: /etc/traefik/certs/traefik.example.com.key.pem

用于 postgres 和 pgadmin 的 docker-compose.yml

services:
  postgres:
    container_name: postgres
    image: postgres
    restart: always
    ports:
      - '5434:5432'
    volumes:
      - pg-dataset:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: test1234
    networks:
      - dev
  pgadmin:
    container_name: pgadmin
    image: dpage/pgadmin4
    restart: always
    depends_on:
      - postgres
    ports:
      - '53603:53603'
      - '8081:80'
    volumes:
      - pgadmin-data:/var/lib/pgadmin
    environment:
      PGADMIN_DEFAULT_EMAIL: admin@example.com
      PGADMIN_DEFAULT_PASSWORD: root
    labels:
      - traefik.http.middlewares.pgadmin_https.redirectscheme.scheme=https
      - traefik.http.routers.pgadmin.entrypoints=web
      - traefik.http.routers.pgadmin.rule=Host(`pgadmin.example.com`)
      - traefik.http.routers.pgadmin_https.rule=Host(`pgadmin.example.com`)
      - traefik.http.routers.pgadmin.middlewares=pgadmin_https@docker
      - traefik.http.routers.pgadmin_https.tls=true
      - traefik.http.routers.pgadmin_https.entrypoints=websecure
    networks:
      - dev

volumes:
  pg-dataset:
  pgadmin-data:

networks:
  dev:
    external:
      name: dev

在此设置中我应该在哪里存储例如 pgadmin 的证书？

过去我习惯使用 nginx，因此我现在对 traefik 有点困惑。

感谢您的帮助，我真的很感激。

Answer 1

这是我的 docker-compose.yml 的配置：

version: '2'
services:
  pgadmin:
    image: dpage/pgadmin4
    container_name: pgadmin4_container
    restart: always
    ports:
      - "5543:443"
    environment:
      PGADMIN_DEFAULT_EMAIL: dba@mail.org
      PGADMIN_DEFAULT_PASSWORD: mypass
      PGADMIN_ENABLE_TLS: 1
      PGADMIN_LISTEN_PORT: 443
    volumes:
      - pgadmin-data:/var/lib/pgadmin
      - /opt/deploy_tools/_traefik/conf/ssl/cert.crt:/certs/server.cert
      - /opt/deploy_tools/_traefik/conf/ssl/cert.key:/certs/server.key
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pgadmin4.entrypoints=websecure"
      - "traefik.http.routers.pgadmin4.rule=Host(`pgadmin.myorg.fr`)"
      - "traefik.http.routers.pgadmin4.tls=true"
      - "traefik.http.routers.pgadmin4.tls.certresolver=myresolver"
      - "traefik.http.services.pgadmin4-https.loadbalancer.server.port=443"
volumes:
  pgadmin-data:
networks:
    traefik:
        external:
            name: traefik

我正在运行一个独立的 pgadmin，它通过 traefik 网络访问 postgreSQL 实例。 Traefik 也在容器后面运行。

来源：https://www.pgadmin.org/docs/pgadmin4/latest/container_deployment.html#mapped-files-and-directories