docker - 努力将Nginx代理+ LetsEncrypt伴侣与我的Docker组成的Web应用程序集成

Question

我要达到的目的

我正在尝试为自己的生产站点集成SSL证书，如果我可以为本地开发创建自签名证书，那将是奖励。

我遇到的问题

尝试集成nginx-proxy和letsencrypt-companion时，始终会导致重定向循环或502错误的网关错误。

我已经研究了多种方法来集成这两个同伴，但是我仍然对如何进行集成感到困惑，但是在尝试集成到我的环境中时总是问自己同样的问题。

有关我的环境的更多详细信息

我正在运行使用PHP / PHP-FPM 7.2，MySQL和Nginx的多容器Docker Compose Web应用程序。配置看起来像:

version: '3.1'

networks:
  mywebapp:

services:
  nr_nginx:
    build: ./env/nginx
    networks:
      - mywebapp
    ports:
      - 80:80
      - 443:443
    env_file:
      - ./env/nginx/.env
    depends_on:
      - nr_php72
    tty: true
    volumes:
      - ./src:/home/www/mywebapp/src
      - ./storage:/home/www/storage/mywebapp
      - ./data/nginx/logs:/var/log/nginx
      - ./env/nginx/webserver/nginx.conf:/etc/nginx/nginx.conf
      - ./env/nginx/webserver/conf.d:/etc/nginx/conf.d
      - ./env/nginx/webserver/defaults:/etc/nginx/defaults
      - ./env/nginx/webserver/global:/etc/nginx/global
      - ./env/nginx/ssl/:/etc/letsencrypt/
      - ./env/nginx/share:/usr/share/nginx/html
      - /var/run/docker.sock:/tmp/docker.sock:ro

  nr_mysql:
    build: ./env/mysql
    networks:
      - mywebapp
    ports:
      - 3306:3306
    env_file:
      - ./env/mysql/.env
    volumes:
      - ./data/mysql:/var/lib/mysql
      - ./env/mysql/conf.d:/etc/mysql/conf.d
      - ./data/dbimport/:/docker-entrypoint-initdb.d

  nr_php72:
    build: ./env/php72
    hostname: php72
    networks:
      - mywebapp
    depends_on:
      - nr_mysql
    ports:
      - 9000:9000
      - 8080:8080
    volumes:
      - ./env/composer:/home/www/.composer
      - ./env/global/bashrc:/home/www/.bashrc
      - ./data/bash/.bash_history:/home/www/.bash_history
      - ~/.ssh:/home/www/.ssh:ro
      - ~/.gitconfig:/home/www/.gitconfig:ro
      - ./storage:/home/www/storage/mywebapp
      - ./src:/home/www/mywebapp/src

问题

Nginx代理是否应该替换我现有的“nr_nginx”容器？

是否已删除“nr_nginx”的80:80、433:433端口映射，而是分配了我选择的随机唯一端口，例如5000？

如果问题2是，我如何告诉nginx-proxy将代理传递给端口5000的容器？

Answer 1

好的，我想我已经解决了:

不，它不应该替换您自己的nginx配置

是的，删除端口80和443，因为这将由nginx-proxy处理，而不是公开容器中的端口。

只要您指定proxy_pass环境变量，您就不需要手动配置VIRTUAL_PORT，因为nginx-proxy会为您执行此操作。

这是为我工作的样板代码:

锅炉面板nginx-proxy-letsencrypt-companion

docker-compose.yml:

version: "3"
services:
  nginx-proxy:
    image: jwilder/nginx-proxy
    container_name: nginx-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./env/nginx/certs:/etc/nginx/certs
      - ./env/nginx/vhost.d:/etc/nginx/vhost.d
      - ./env/nginx/share:/usr/share/nginx/html

  letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    container_name: letsencrypt
    volumes:
      - ./env/nginx/certs:/etc/nginx/certs
      - ./env/nginx/vhost.d:/etc/nginx/vhost.d
      - ./env/nginx/share:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - NGINX_PROXY_CONTAINER=nginx-proxy

networks:
  default:
    external:
      name: nginx-proxy

Boilerplate Nginx PHP MySQL环境

docker-compose.yml

version: '3.1'

services:

  nginx:
    container_name: nginx
    build: ./env/nginx
    ports:
      - 5000:5000
    expose:
      - 80
      - 443
    environment:
      - VIRTUAL_HOST=your.domain.com,www.your.domain.com
      - VIRTUAL_PORT=5000
      - LETSENCRYPT_EMAIL=your@email.com
      - LETSENCRYPT_HOST=your.domain.com
    depends_on:
      - php72
    tty: true
    volumes:
      - ./src:/home/www/webapp/src
      - ./storage:/home/www/storage/webapp
      - ./data/nginx/logs:/var/log/nginx
      - ./env/nginx/webserver/nginx.conf:/etc/nginx/nginx.conf
      - ./env/nginx/webserver/conf.d:/etc/nginx/conf.d
      - ./env/nginx/webserver/defaults:/etc/nginx/defaults
      - ./env/nginx/webserver/global:/etc/nginx/global
      - /var/run/docker.sock:/tmp/docker.sock:ro

  mysql:
    container_name: mysql
    build: ./env/mysql
    ports:
      - 3306:3306
    env_file:
      - ./env/mysql/.env
    volumes:
      - ./data/mysql:/var/lib/mysql
      - ./env/mysql/conf.d:/etc/mysql/conf.d
      - ./data/dbimport/:/docker-entrypoint-initdb.d

  php72:
    container_name: php72
    build: ./env/php72
    hostname: php72
    depends_on:
      - mysql
    ports:
      - 9000:9000
    volumes:
      - ./env/composer:/home/www/.composer
      - ./env/global/bashrc:/home/www/.bashrc
      - ./data/bash/.bash_history:/home/www/.bash_history
      - ~/.ssh:/home/www/.ssh:ro
      - ~/.gitconfig:/home/www/.gitconfig:ro
      - ./storage:/home/www/storage/webapp
      - ./src:/home/www/webapp/src

networks:
  default:
    external:
      name: nginx-proxy

/etc/nginx/conf.d/default.conf-在“nginx”容器中:

server {

    listen 5000;
    listen [::]:5000;

    server_name www.your.domain.com;

    root /my/web/root/src;
    index index.php;

    include /any/conf/includes/here.conf;

    location / {
        fastcgi_param HTTPS 'on';
        try_files $uri $uri/ /index.php$is_args$args;
    }
}

fastcgi_param HTTPS 'on'; conf防止重定向循环，您也可以将 $_SERVER['HTTPS'] = 'on';添加到index.php