node.js - 如何在 docker 中使用 certbot 正确安装 ssl 证书？

Question

我正在尝试使用 Let's Encrypt SSL 证书为 HTTPS 使用 Docker 部署 Node.js/Express 应用程序。

当我运行 docker-compose up 命令时，所有 3 个服务都启动了，但我注意到这样的警告:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
No certs found.

当 docker 尝试在 certbot/Dockerfile 文件中执行 RUN/scripts/certbot-auto -n certificates 命令时会出现此警告。

在 /var/log/letsencrypt/letsencrypt.log 文件中我看到了这个:

2019-08-21 10:27:50,354:DEBUG:certbot.main:certbot version: 0.37.1
2019-08-21 10:27:50,355:DEBUG:certbot.main:Arguments: ['-n']
2019-08-21 10:27:50,355:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#manual,PluginEntryPoint#nginx,Plugin$
2019-08-21 10:27:50,372:DEBUG:certbot.log:Root logging level set at 20
2019-08-21 10:27:50,372:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log

同样在 nginx 容器的日志中，我注意到这样的警告:

2019/08/21 10:28:37 [emerg] 1#1: cannot load certificate "/etc/letsencrypt/live/tols/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/tols/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file) 

问题:据我了解，未创建 ssl 证书。如何解决此问题并使用 certbot 正确安装证书？

结构:

certbot/
    certbot-auto
    Dockerfile
    register
nginx/
    Dockerfile
    nginx.conf
server/
    bin/
        www.js
Dockerfile
docker-compose.yml

docker-compose.yml:

version: '3'

services:
  frontend:
    build: ./
    image: tols_frontend_image
    container_name: tols_frontend_container
    restart: always
    volumes:
    - certbot-webroot-tols:/tols-frontend/public/.well-known
    - certbot-letsencrypt:/etc/letsencrypt

  certbot:
    build: ./certbot
    image: tols_certbot_image
    container_name: tols_certbot_container
    restart: always
    volumes:
    - certbot-webroot-tols:/webroots/tols/.well-known
    - certbot-letsencrypt:/etc/letsencrypt

  nginx:
    build: ./nginx
    image: tols_nginx_image
    container_name: tols_nginx_container
    ports:
    - "9012:80"
    - "9013:443"
    restart: always
    volumes:
    - certbot-webroot-tols:/webroots/tols/.well-known
    - certbot-letsencrypt:/tols/letsencrypt

volumes:
  certbot-webroot-tols:
  certbot-letsencrypt:

certbot/Dockerfile:

FROM debian:jessie

RUN apt-get update && apt-get install -y cron bash wget
RUN mkdir -p /webroots/tols/.well-known /scripts

WORKDIR /scripts
COPY certbot-auto certbot-auto
RUN chmod a+x ./certbot-auto
RUN /scripts/certbot-auto -n certificates
COPY register /scripts/
RUN chmod +x /scripts/register

VOLUME /webroots
VOLUME /etc/letsencrypt
RUN echo "0 0 1 * * root /scripts/certbot-auto renew" >/etc/cron.d/certbot

CMD [ "cron", "-f" ]

certbot/注册:

#!/bin/sh
/scripts/certbot-auto certonly --webroot -w /webroots/$1 -d $1

nginx/Dockerfile:

FROM nginx
COPY nginx.conf /etc/nginx/nginx.conf
EXPOSE 80
EXPOSE 443

nginx/nginx.conf:

user  root;
worker_processes  1;
error_log  /var/log/nginx-error.log debug;
pid        /var/run/nginx.pid;
events {
    worker_connections  1024;
}
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx-access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    server {
        listen 80;
        listen [::]:80 default_server ipv6only=on;
        return 301 https://$host$request_uri;
    }
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name tols;
        ssl_certificate /etc/letsencrypt/live/tols/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/tols/privkey.pem;
        location / {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-NginX-Proxy true;
            proxy_pass http://frontend:3010/;
            proxy_ssl_session_reuse off;
            proxy_set_header Host $http_host;
            proxy_cache_bypass $http_upgrade;
            proxy_redirect off;
        }
        location /.well-known {
            root /webroots/tols/.well-known;
        }
    }
}

Answer 1

只需使用此命令部署 docker 容器即可安装 letencrypt ssl 证书

docker run \
--name=letsencrypt \
--cap-add=NET_ADMIN \
-e PUID=1000 \
-e PGID=1000 \
-e TZ=Europe/London \
-e URL=your.domain.com \
-e VALIDATION=http \
-e EMAIL=****@gmail.com \
-e PROD=true \
-p 443:443 \
-p 80:80 \
-v /path/to/appdata/config:/config \
-d \
--restart unless-stopped \
linuxserver/letsencrypt

现在使用/app/le-renew.sh 中可用的脚本自动续订证书安装 crontab 来执行此操作

0 0 1 * * sudo docker exec letsencrypt /app/le-renew.sh