docker - 带有 Nginx 的 Taskwarrior 任务服务器

Question

我的当前配置是 docker + taskserver + nginx 反向代理，当我连接时使用task sync它失败。

$ task sync
c: 1 Received record packet of unknown type 72
Syncing with task.reggi.com:80

Handshake failed.  An unexpected TLS packet was received.
Sync failed.  Could not connect to the Taskserver.

我相信正在发生的事情是，taskserver守护进程不同于“普通”服务器，并且也在努力设置证书，nginx 也是如此。

• 我已经运行让我们在域上加密并收到证书
• 我跑了pki/generate.ca
• 我跑了pki/generate.client reggi
• 我在客户端上指向这些
• 我尝试了 ca 证书与客户端上的让加密证书的不同组合

.taskrc

taskd.certificate=/Users/thomas/Desktop/cloud/taskserver/pki/reggi.cert.pem
taskd.key=/Users/thomas/Desktop/cloud/taskserver/pki/reggi.key.pem
taskd.ca=~/.task/both.pem
taskd.server=task.reggi.com:80
taskd.credentials=Private/Thomas Reggi/2f397682-40d8-4b83-a7f4-de2bda1a31f1

变量

BITS=4096
EXPIRATION_DAYS=365
ORGANIZATION="REGGI CORP"
CN=task.reggi.com
COUNTRY=US
STATE="NEW YORK"
LOCALITY="NEW YORK"

配置

confirmation=1
extensions=/usr/local/libexec/taskd
ip.log=on
log=/var/log/taskd.log
pid.file=/tmp/taskd.pid
queue.size=10
request.limit=1048576
root=/var/taskd
server=0.0.0.0:53589
trust=strict
verbose=1
ca.cert=/var/taskd/pki/ca.cert.pem
server.cert=/etc/nginx/certs/task.reggi.com/fullchain.pem
server.key=/etc/nginx/certs/task.reggi.com/key.pem
client.key=/var/taskd/pki/client.key.pem
client.cert=/var/taskd/pki/client.cert.pem

服务器正在启动

taskserver_1         | 20180511T072403Z 1.2.0 info ==== taskd 1.2.0 6f5929c ====
taskserver_1         | 20180511T072403Z 1.2.0 info Serving from /var/taskd
taskserver_1         | 20180511T072403Z 1.2.0 info Using address 0.0.0.0
taskserver_1         | 20180511T072403Z 1.2.0 info Using port 53589
taskserver_1         | 20180511T072403Z 1.2.0 info Using family
taskserver_1         | 20180511T072403Z 1.2.0 info Queue size 10 requests
taskserver_1         | 20180511T072403Z 1.2.0 info Request size limit 1048576 bytes
taskserver_1         | 20180511T072403Z 1.2.0 info IP logging on
taskserver_1         | 20180511T072403Z 1.2.0 info CA          /var/taskd/pki/ca.cert.pem
taskserver_1         | 20180511T072403Z 1.2.0 info Certificate /etc/nginx/certs/task.reggi.com/fullchain.pem
taskserver_1         | 20180511T072403Z 1.2.0 info Private Key /etc/nginx/certs/task.reggi.com/key.pem
taskserver_1         | 20180511T072403Z 1.2.0 info Server starting
taskserver_1         | 20180511T072403Z 1.2.0 info Using dh_bits: 0

当我结合 let's encrypt cert 和 ca cert for client auth 时，有时我会得到：

$ task sync
c: 1 There was a non-CA certificate in the trusted list: CN=task.reggi.com.
c: 1 Received record packet of unknown type 72
Syncing with task.reggi.com:80

Handshake failed.  An unexpected TLS packet was received.
Sync failed.  Could not connect to the Taskserver.

我还按照上面描述的一些设置来匹配本教程，但仍然没有运气。

https://taskwarrior.org/support/faq.html#q12

领导：来自 Debian 的这个旧问题指出：

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806426

这是我的 443->4443 端口转发的错误防火墙规则，以便能够在非特权端口上运行服务器。

我非常抱歉。禁用此防火墙规则后，我可以毫无问题地连接到所有 https。

这是我的nginx配置。

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
  default $http_x_forwarded_port;
  ''      $server_port;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}
# Apply fix for very long server names
server_names_hash_bucket_size 128;
# Default dhparam
# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
  default off;
  https on;
}
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';
access_log off;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_request_buffering off;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
server {
    server_name _; # This is just an invalid value which will never trigger on a real hostname.
    listen 80;
    access_log /var/log/nginx/access.log vhost;
    return 503;
}
# registry.reggi.com
upstream registry.reggi.com {
                ## Can be connected with "webproxy" network
            # main_registry_1
            server 172.19.0.6:80;
}
server {
    server_name registry.reggi.com;
    listen 80 ;
    access_log /var/log/nginx/access.log vhost;
    return 301 https://$host$request_uri;
}
server {
    server_name registry.reggi.com;
    listen 443 ssl http2 ;
    access_log /var/log/nginx/access.log vhost;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS';
    ssl_prefer_server_ciphers on;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_certificate /etc/nginx/certs/registry.reggi.com.crt;
    ssl_certificate_key /etc/nginx/certs/registry.reggi.com.key;
    ssl_dhparam /etc/nginx/certs/registry.reggi.com.dhparam.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/certs/registry.reggi.com.chain.pem;
    add_header Strict-Transport-Security "max-age=31536000" always;
    include /etc/nginx/vhost.d/default;
    location / {
        proxy_pass http://registry.reggi.com;
    }
}
# task.reggi.com
upstream task.reggi.com {
                ## Can be connected with "webproxy" network
            # main_taskserver_1
            server 172.19.0.3:53589;
}
server {
    server_name task.reggi.com;
    listen 80 ;
    access_log /var/log/nginx/access.log vhost;
    return 301 https://$host$request_uri;
}
server {
    server_name task.reggi.com;
    listen 443 ssl http2 ;
    access_log /var/log/nginx/access.log vhost;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS';
    ssl_prefer_server_ciphers on;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_certificate /etc/nginx/certs/task.reggi.com.crt;
    ssl_certificate_key /etc/nginx/certs/task.reggi.com.key;
    ssl_dhparam /etc/nginx/certs/task.reggi.com.dhparam.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/certs/task.reggi.com.chain.pem;
    add_header Strict-Transport-Security "max-age=31536000" always;
    include /etc/nginx/vhost.d/default;
    location / {
        proxy_pass http://task.reggi.com;
    }
}

Github 问题：https ://github.com/GothenburgBitFactory/taskserver/issues/141

：更新：

我取得了很大的进步。

我删除了我的所有 nginx 特定的东西，然后我将端口更改为docker-compose.yml我正在运行的数字海洋服务器公开端口 443。所以我能够在没有 nginx 的情况下运行 Taskserver。在客户端上，我必须删除端口 80，因为 taskserver 在 443 上暴露，所以我更改了配置以读取我为使其正常工作所做的另一件事是我在客户端上指向这个下载的让我们加密证书，然后我运行它并且它工作！taskserver443:53589taskd.server=task.reggi.com:443taskd.ca=https://letsencrypt.org/certs/letsencryptauthorityx3.pem.txttask sync

然而...

当我恢复 nginx 配置时，它不再工作了。

➜  cloud git:(master) task sync
Syncing with task.reggi.com:443

Handshake failed.  Error in the certificate.
Sync failed.  Could not connect to the Taskserver.
➜  cloud git:(master) task sync
c: 1 Received record packet of unknown type 72
Syncing with task.reggi.com:80

Handshake failed.  An unexpected TLS packet was received.
Sync failed.  Could not connect to the Taskserver.

标签： dockersslnginxlets-encrypttaskwarrior