Nginx over TLS 与 docker compose答案

【问题标题】：Nginx over TLS with docker composeNginx over TLS 与 docker compose
【发布时间】：2020-09-28 12:24:16
【问题描述】：

信息：

Nginx 服务器
码头工人
Docker-compose
Docker 群

当前：

我的前端可以通过 http 访问。一切正常。

我想要什么：

我需要更新到 https。

问题：

当我添加配置数据（公钥和私钥）时，它在本地运行良好。当它在 docker swarm 上运行我得到 400 over http（来自 nginx），没关系。

问题是 https 不起作用，它无法到达前端。我认为我在 docker-compose 中的配置一定有问题。

nginx.conf

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    server {
        listen 8080 ssl;
        ssl_certificate     /cert/public.crt;
        ssl_certificate_key /cert/private.key;

        root   /usr/share/nginx/html;
        index  index.html index.htm;
        include /etc/nginx/mime.types;

        gzip on;
        gzip_min_length 1000;
        gzip_proxied expired no-cache no-store private auth;
        gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

    }
}

Docker-compose.yaml

version: '3.7'

networks:
  my_network:
    external: true
services:
  microfrontend-root:
    image: ${CONTAINER_IMAGE}:single_spa_root-${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      my_network:
    deploy:
      resources:
        limits:
          cpus: '0.2'
          memory: ${MEMORY_LIMIT}
      placement:
        constraints:
          - node.labels.${SERVER_LABEL}==true
      labels:
        - "traefik.backend=dev_single_spa_root"
        - "traefik.port=8080"
        - "traefik.docker.network=my_network"
        - "traefik.frontend.tls=true"
        - "traefik.frontend.rule=Host:my-host.net;PathPrefixStrip:/subpath/"
        - "com.application=MyName"
        - "com.component=single_spa_root"
        - "com.environment=dev"

感谢您的帮助！

【问题讨论】：

就像这样，如果你已经使用 Traefik，那么你可以简单地使用它来创建 SSL 证书。或者这不是你想要的？而且你的 Nginx 配置看起来有点不对。

标签： docker nginx docker-compose docker-swarm

【解决方案1】：

只是一个例子：

server {

        server_name YOUR-DOMAIN.COM;

        location / {
                proxy_pass http://IP-OR-NAME-FROM-YOUR-DOKCER-SERVICE:8080;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $http_host;

                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forward-Proto http;
                proxy_set_header X-Nginx-Proxy true;

                proxy_redirect off;

        }
        listen [::]:443 ssl;
        listen 443 ssl;
        ssl_certificate     /cert/public.crt;
        ssl_certificate_key /cert/private.key;
}

# Redirect all to https
server {
    if ($host = YOUR-DOMAIN.COM) {
        return 301 https://$host$request_uri;
    } 
        listen 80;
        listen [::]:80;

        server_name YOUR-DOMAIN.COM;
        return 404;
}

【讨论】：