docker - Traefik 将 SSL 转发到 php-nginx docker 映像（到 Laravel 的 https 流量）
问题描述
我需要一些有关 Traefik 或 Nginx 设置的专家建议。一些线索会很好。
starapp - 我想在这里运行一个 Laravel 应用程序。我注意到当一个请求使用 HTTP 到达 laravel 应用程序时，响应变得混杂。所以我试图将整个 SSL 流量发送到 laravel 应用程序。
这是我为 php-nginx docker 编写的 docker-compose。我可以启动码头工人。但是，当请求命中此实例时。我在starapp的docker日志中收到错误。
码头工人-compose.yml
starapp:
image: webdevops/php-nginx:7.4
container_name: starapp
depends_on:
- mysql
restart: always
environment:
- PHP_DISPLAY_ERRORS=1
- PHP_MEMORY_LIMIT=2048M
- PHP_MAX_EXECUTION_TIME=300
- PHP_POST_MAX_SIZE=500M
- PHP_UPLOAD_MAX_FILESIZE=256M
- WEB_ALIAS_DOMAIN=app.starthardware.com.my
volumes:
- ./starhardware.com.my/app/:/app
#- ./etc/nginx/default.conf:/etc/nginx/conf.d/default.conf
#- ./etc/nginx/default.template.conf:/etc/nginx/conf.d/default.template
- /opt/containers/ngixbased/data/assets/ssl/app.starhardware.com.my:/etc/ssl
expose:
- 443
labels:
- traefik.enable=true
- traefik.http.services.starapp.loadbalancer.server.scheme=https
- traefik.http.routers.starapp-secure.rule=Host(`app.starhardware.com.my`)
- traefik.http.routers.starapp-secure.entrypoints=https
- traefik.http.routers.starapp-secure.tls=true
- traefik.http.routers.starapp-secure.tls.certresolver=letsEncrypt
networks:
- proxy
- backend
当请求命中此 docker 实例时，我收到以下错误
starapp | [18-Aug-2021 04:12:22] NOTICE: fpm is running, pid 49
starapp | [18-Aug-2021 04:12:22] NOTICE: ready to handle connections
starapp | 2021-08-18 04:12:23,352 INFO success: syslogd entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
starapp | [SYSLOG] CRON[86]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
starapp | 192.168.144.3 - - [18/Aug/2021:04:22:29 +0000] "\x16\x03\x01\x01\x00\x01\x00\x00\xFC\x03\x034\xF1\xAF|Z\xEE\xC2\xD9rU\x07\x99:\xF8^a\xB6\xC1\x91\x18\x80\xF4\xAE\xE7!A\xC9\xF8" 400 173 "-" "-"
starapp | 192.168.144.3 - - [18/Aug/2021:04:22:29 +0000] "\x16\x03\x01\x01\x00\x01\x00\x00\xFC\x03\x03\x03q\x1B\xC3\x18_\xE1" 400 173 "-" "-"
接下来我做了一个查看 docker 实例中的 nginx -T 状态。
root@cdeb5cd6f9e8:/# nginx -T
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
access_log /docker.stdout ;
error_log /docker.stderr ;
##
# Gzip Settings
##
gzip on;
# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
#mail {
# # See sample authentication script at:
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
# # auth_http localhost/auth.php;
# # pop3_capabilities "TOP" "USER";
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
# server {
# listen localhost:110;
# protocol pop3;
# proxy on;
# }
#
# server {
# listen localhost:143;
# protocol imap;
# proxy on;
# }
#}
# configuration file /etc/nginx/modules-enabled/50-mod-http-auth-pam.conf:
load_module modules/ngx_http_auth_pam_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-dav-ext.conf:
load_module modules/ngx_http_dav_ext_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-echo.conf:
load_module modules/ngx_http_echo_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip.conf:
load_module modules/ngx_http_geoip_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-subs-filter.conf:
load_module modules/ngx_http_subs_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-upstream-fair.conf:
load_module modules/ngx_http_upstream_fair_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;
# configuration file /etc/nginx/mime.types:
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/png png;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
image/svg+xml svg svgz;
image/webp webp;
application/font-woff woff;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.wap.wmlc wmlc;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}
# configuration file /etc/nginx/conf.d/10-docker.conf:
include /opt/docker/etc/nginx/global.conf;
include /opt/docker/etc/nginx/php.conf;
include /opt/docker/etc/nginx/conf.d/*.conf;
include /opt/docker/etc/nginx/vhost.conf;
# configuration file /opt/docker/etc/nginx/global.conf:
# deprecated
# configuration file /opt/docker/etc/nginx/php.conf:
# deprecated
# configuration file /opt/docker/etc/nginx/conf.d/10-php.conf:
upstream php {
server 127.0.0.1:9000;
}
# configuration file /opt/docker/etc/nginx/vhost.conf:
server {
listen 80 default_server;
server_name _ app.starthardware.com.my docker;
root "/app";
index index.php;
include /opt/docker/etc/nginx/vhost.common.d/*.conf;
}
##############
# SSL
##############
server {
listen 443 default_server;
server_name _ app.starthardware.com.my docker;
root "/app";
index index.php;
include /opt/docker/etc/nginx/vhost.common.d/*.conf;
include /opt/docker/etc/nginx/vhost.ssl.conf;
}
# configuration file /opt/docker/etc/nginx/vhost.common.d/10-general.conf:
client_max_body_size 50m;
# configuration file /opt/docker/etc/nginx/vhost.common.d/10-location-root.conf:
location / {
try_files $uri $uri/ /index.php?$query_string;
}
# configuration file /opt/docker/etc/nginx/vhost.common.d/10-log.conf:
access_log /docker.stdout;
error_log /docker.stderr warn;
# configuration file /opt/docker/etc/nginx/vhost.common.d/10-php.conf:
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $request_filename;
fastcgi_read_timeout 600;
}
# configuration file /etc/nginx/fastcgi_params:
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REQUEST_SCHEME $scheme;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
# configuration file /opt/docker/etc/nginx/vhost.ssl.conf:
ssl on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # not possible to do exclusive
ssl_ciphers 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA';
ssl_prefer_server_ciphers on;
ssl_certificate /opt/docker/etc/nginx/ssl/server.crt;
ssl_certificate_key /opt/docker/etc/nginx/ssl/server.key;
root@cdeb5cd6f9e8:/# code here
有什么建议吗？或者我还可以检查什么来确定这种情况的根源。
谢谢你。
解决方案
这是我们的docker-compose文件。
nginx:
image: "nginx:alpine"
ports:
- 5000:443
links:
- registry:registry
volumes:
- ./auth:/etc/nginx/conf.d
- ./auth/nginx.conf:/etc/nginx/nginx.conf:ro
registry:
image: registry:2.7.0
volumes:
- ./data:/var/lib/registry
我们使用nginx前面。这里registry的部分实际上与 docker-registry 容器有关。我认为您可以在那里替换您的应用程序。但是使用webdevops/php-nginx:7.4可能会给您带来问题，因为它具有内置功能nginx