Docker 反向代理、Nginx、MEAN 堆栈

Question

大家好，我收到 400 代码响应。我正在尝试在 docker 上部署 MEAN 堆栈应用程序，因此我使用反向代理来进行后端和前端通信，而无需端口

我的 https://site.app/api 工作，但我的前端得到了

400 bad request 普通的 http 请求被发送到 https

这对我来说是新的，所以我看了一些教程和帖子来解决它，但我没有任何解决方案 如果我只是将 ssl 放在前端，它可以工作，但是当我尝试发送数据或类似的东西时，我的后端会出现 ssl 错误连接的错误

我已经通过邮递员发送了带有 url https://site.app/api 的数据，所以我可以说它有效

DOCKERFILE

FROM node:14.3.0  As builder
RUN mkdir -p /usr/src/app

WORKDIR /usr/src/app/

COPY package*.json ./

RUN npm install

COPY . .

RUN npm run build --prod

FROM nginx:1.19

COPY --from=builder /usr/src/app/dist/advanced-angular/ /usr/share/nginx/html

RUN rm -rf /etc/nginx/conf.d/default.conf

EXPOSE 80
EXPOSE 443

CMD ["nginx", "-g", "daemon off;"]

这是我的 docker-compose 文件

Docker 编写

version: "3.6" # Version del docker-compose
services: # Definir la lista de servicios que se crearan

  frontend: # nombre del primer servicio
    image: myImage
    restart: always
    container_name: frontend
    # command: ["npm", "start"]
    ports:
      - "80:80" # Especificar el puerto que sera Mapeado
      - "443:443"
    volumes: #el volume donde estara el projecto para que pueda ser editatado
      - ./ssl/:/etc/nginx/ssl/
      - ./nginx-conf/:/etc/nginx/conf.d/
    networks:
      - webNet
    depends_on: 
      - backend
      - mongo

  backend:
    image: myImage
    restart: always
    container_name: backend
    env_file: .env
    environment:
      - MONGO_USERNAME=$MONGO_USERNAME
      - MONGO_PASSWORD=$MONGO_PASSWORD
      - MONGO_HOSTNAME=mongo
      - MONGO_PORT=$MONGO_PORT
      - MONGO_DB=$MONGO_DB
    # command: ["npm", "run", "dev"]
    ports:
      - "3000:3000"
    # volumes: 
      # - ./api-server:/usr/src/app
    networks:
      - webNet
    depends_on:
      - mongo

  mongo:
    image: mongo:4.2.7-bionic 
    restart: always
    container_name: mongo
    env_file: .env
    environment:
      - MONGO_INITDB_ROOT_USERNAME=$MONGO_USERNAME
      - MONGO_INITDB_ROOT_PASSWORD=$MONGO_PASSWORD
    ports:
      - "27017:27017"
    networks:
      - webNet
    volumes: 
      - /opt/mongo/prod:/data/db

networks:
  webNet:
    driver: bridge

我的 nginx 配置 nginx.conf

upstream frontend {
    least_conn;
    server frontend:443 max_fails=3 fail_timeout=30s;
}
upstream backend {
    least_conn;
    server backend:3000 max_fails=3 fail_timeout=30s;
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    server_name vecin.app www.vecin.app;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ecdh_curve secp384r1;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;
    ssl_prefer_server_ciphers on;
    ssl_certificate /etc/nginx/ssl/chain.crt;
    ssl_certificate_key /etc/nginx/ssl/key.key;

    ssl_session_timeout 10m;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/ssl/chain.crt;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 30s;

    location / {
        proxy_pass http://frontend;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto   $scheme;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-NginX-Proxy true;
        proxy_ssl_certificate /etc/nginx/ssl/chain.crt;
        proxy_ssl_certificate_key /etc/nginx/ssl/key.key;
        proxy_ssl_protocols TLSv1.2;
        proxy_ssl_verify        on;
        proxy_ssl_verify_depth  2;
        proxy_ssl_session_reuse on;
        # proxy_redirect http:// https://;

    }

    location /api{
        proxy_pass http://backend;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto   $scheme;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-NginX-Proxy true;
        proxy_ssl_certificate /etc/nginx/ssl/chain.crt;
        proxy_ssl_certificate_key /etc/nginx/ssl/key.key;
        proxy_ssl_protocols TLSv1.2; 
        proxy_ssl_verify        on;
        proxy_ssl_verify_depth  2;
        proxy_ssl_session_reuse on;
        # proxy_redirect http:// https://;
    }
    root /usr/share/nginx/html/;
    index index.html index.htm index.nginx-debian.html;
}

server {
    listen 80;
    listen [::]:80;
    server_name vecin.app www.vecin.app;

     location / {
            rewrite ^ https://$host$request_uri? permanent;
    }
}

Answer 1

我承认我不是 nginx 高手，我正在猜测解决方案。我会发布这个答案，因为到目前为止没有其他人给你答案。

我注意到nginx.conf 文件中的措辞与我在在线指南中看到的将所有 HTTP 流量重定向到 nginx 上的 HTTPS 的措辞略有不同。您的文件在此部分结束：

server {
    listen 80;
    listen [::]:80;
    server_name vecin.app www.vecin.app;

     location / {
            rewrite ^ https://$host$request_uri? permanent;
    }
}

我看到的指南建议这种格式可能更合适：

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

关键区别似乎是返回 301 永久重定向，而不是简单地重写 URL。错误消息似乎是关于将 HTML 发送到需要 HTTPS 的端口。这就是向我建议 Docker 容器运行良好，Docker 网络运行正常，nginx 正在运行。这使得您重定向流量的机制成为主要嫌疑人。让我们知道这是否有效！

这里是指南：Redirect all HTTP requests to HTTPS with Nginx