docker - 了解与Docker结合使用的反向代理

Question

我在docker-container中使用Nginx代理。而且我必须在一台服务器上运行多个应用程序。我想在一个docker容器中运行它们，除了一个。我在容器中运行Jira an Confluence。我花了很多时间来配置应用程序和Nginx-config。现在，我也想在服务器上运行Graylog2，并且遇到了类似的问题，如Jira / Confluence。我想可能是因为我不太了解所有这些工作原理。这就是为什么我做出以下图像:


那就是我如何理解反向代理。 Nginx-conf看起来像这样:

upstream jenkins {
  server 43.3.34.333:8080 fail_timeout=0;
}

upstream docker-jira {
    server jira:8080;
}

upstream docker-conf {
        server conf:8090;
}

upstream docker-graylog {
    server graylog:9000;
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;


    server_name mySite.de;
    return 301 https://mySite.de;
}


server {

    # SSL configuration

    listen 443 ssl http2 default_server;

    listen [::]:443 ssl http2 default_server;

    server_name mySite.de;

    include snippets/ssl-mySite.de;

    include snippets/ssl-params.conf;

    location /jenkins {
            proxy_set_header        Host $host:$server_port;
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        X-Forwarded-Proto $scheme;
            proxy_pass              http://jenkins;
            proxy_redirect      http://jenkins $scheme://mySite.de;
            # Required for new HTTP-based CLI
            proxy_http_version 1.1;
            proxy_request_buffering off;
            proxy_buffering off; # Required for HTTP-based CLI to work over SSL
            # workaround for https://issues.jenkins-ci.org/browse/JENKINS-45651
            add_header 'X-SSH-Endpoint' 'jenkins.domain.tld:50022' always;
            client_max_body_size 2M;
    }

    location /graylog {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Graylog-Server-URL http://$server_name/api;
        proxy_pass       http://docker-graylog/graylog;
    }

    location /jira {

        proxy_set_header X-Forwarded-Host $host;

        proxy_set_header X-Forwarded-Server $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://docker-jira/jira;

        client_max_body_size 100M;

        add_header X-Frame-Options ALLOW;

    }

    location /confluence {

        proxy_set_header X-Forwarded-Host $host;

        proxy_set_header X-Forwarded-Server $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://docker-conf/confluence;

        proxy_redirect http://docker-conf/confluence https://mySite.de;

        client_max_body_size 100M;

        add_header X-Frame-Options SAMEORIGIN;

    }

    location /synchrony {

        proxy_set_header X-Forwarded-Host $host;

        proxy_set_header X-Forwarded-Server $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://mySite.de:8091/synchrony;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "Upgrade";

        client_max_body_size 100M;

    }

}

要在代理后面运行Graylog2，您必须设置一些设置( Graylog2 docu):

设置web_listen_uri

设置rest_listen_uri

设置web_endpoint_uri

我这样做是这样的:

rest_listen_uri = http://localhost:9000/api/

web_listen_uri = http://localhost:9000/graylog

GRAYLOG_WEB_ENDPOINT_URI:https://mySite.de/api

当我到达 https://mySite.de/graylog时，我收到502 Bad Gateway错误。 Nginx日志:

connect() failed (111: Connection refused) while connecting to upstream, client: 33.11.102.157, server: mySite.de, request: "GET /graylog HTTP/2.0", upstream: "http://172.18.0.9:9000/graylog", host: "mySite.de"

我的网络:

NETWORK ID          NAME                   DRIVER              SCOPE
6c9de2d6b0ac        MyNet                   bridge              local

我真的不明白。

Answer 1

使用NGINX进行SSL终止后，保持80-> 443重定向，然后通过http发送到后端。

更改这些以侦听LAN IP或docker DNS名称:

web_listen_uri = http://docker-graylog:9000/graylog
rest_listen_uri = http://docker-graylog:9000/api

注意:当前配置的问题是它仅在localhost上侦听，而外部传入的请求将永远不会进入应用程序，因为它没有在侦听外部连接。它仅侦听Graylog容器内的连接。 NGINX无法通过局域网访问localhost:9000上的Graylog。

错误的网关表明您的代理服务器可能正在运行，但无法建立与应用程序的连接。

有关更多详细信息:
https://forums.docker.com/t/access-to-localhost-from-bridge-network/22948/2

该配置基本上是您已经拥有的配置，但已从graylog文档中复制了该配置。您当前的代理配置可能会按原样工作。

upstream docker-graylog {
server graylog:9000;
}

server
{
listen      443 ssl spdy;
server_name mySite.de;
# <- your SSL Settings here!

location /graylog
{
  proxy_set_header Host $http_host;
  proxy_set_header X-Forwarded-Host $host;
  proxy_set_header X-Forwarded-Server $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Graylog-Server-URL https://$server_name/api;
  proxy_pass       http://docker-graylog/graylog;
}
}