nginx - 让我们在 AWS ECS 上加密 docker nginx

Question

我正在尝试在 AWS ECS(弹性容器服务)上运行的基于 docker 的应用程序上获取 HTTPS 证书。但是，当最终尝试将 docker 实例部署到 ECS 时，我遇到了一个未定义的问题。

INFO[0120] (service deploy) has started 1 tasks: (task f..........6).  timestamp=2018-03-21 14:52:17 +0000 UTC
FATA[0301] Deployment has not completed: Running count has not changed for 5.00 minutes 

我的设置基于 https://github.com/evertramos/docker-compose-letsencrypt-nginx-proxy-companion谁在杠杆 https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion

不幸的是，两者都没有给出 AWS ECS 的明确示例。我添加的是让我们加密容器的环境变量中的环境变量 DOCKER_PROVIDER=ecs 。创建我的 docker 容器并将它们上传到 ECS 后，我运行了一个特定于 ecs 的 docker-compose

ecs-cli compose --file docker-compose_ec.yml service up

看起来像

version: '2'

services:
  nginx-web:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_nginx
    labels:
        com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: 
"true"
    container_name: ${NGINX_WEB}
    restart: always
    ports:
      - "$0.0.0.0:80:80"
      - "$0.0.0.0:443:443"
    volumes:
      - ${NGINX_FILES_PATH}/conf.d:/etc/nginx/conf.d
      - ${NGINX_FILES_PATH}/vhost.d:/etc/nginx/vhost.d
      - ${NGINX_FILES_PATH}/html:/usr/share/nginx/html
      - ${NGINX_FILES_PATH}/certs:/etc/nginx/certs:ro
      - ${NGINX_FILES_PATH}/htpasswd:/etc/nginx/htpasswd:ro
    logging:
      options:
        max-size: 4m
        max-file: 10
  nginx-gen:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_gen
    command: -notify-sighup ${NGINX_WEB} -watch -wait 5s:30s 
/etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf
   container_name: abc_gen
    restart: always
    volumes:
      - ${NGINX_FILES_PATH}/conf.d:/etc/nginx/conf.d
      - ${NGINX_FILES_PATH}/vhost.d:/etc/nginx/vhost.d
      - ${NGINX_FILES_PATH}/html:/usr/share/nginx/html
      - ${NGINX_FILES_PATH}/certs:/etc/nginx/certs:ro
      - ${NGINX_FILES_PATH}/htpasswd:/etc/nginx/htpasswd:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl:ro
    logging:
      options:
        max-size: 2m
        max-file: 10

  nginx-letsencrypt:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_le
    container_name: abc_le
    restart: always
    volumes:
      - ${NGINX_FILES_PATH}/conf.d:/etc/nginx/conf.d
      - ${NGINX_FILES_PATH}/vhost.d:/etc/nginx/vhost.d
      - ${NGINX_FILES_PATH}/html:/usr/share/nginx/html
      - ${NGINX_FILES_PATH}/certs:/etc/nginx/certs:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      NGINX_DOCKER_GEN_CONTAINER: abc_gen
      NGINX_PROXY_CONTAINER: abc_nginx
      DOCKER_PROVIDER: ecs
    logging:
      options:
        max-size: 2m
        max-file: 10
  api:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_api
    cpu_shares: 50
    mem_limit: 262144000
    ports:
      - '5005:5005' 
  web:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_web
    cpu_shares: 100
    mem_limit: 262144000
    links:
      - api
    environment:
      - API_URL=http://api:5005
      - VIRTUAL_HOST=example.com
      - VIRTUAL_PORT=5000
      - LETSENCRYPT_HOST=example.com
      - LETSENCRYPT_EMAIL=mike@example.com

networks:
   default:
      external:
        name: ${NETWORK}

Web 应用程序在端口 5000 上运行。使用 let's encrypt 运行 Web 应用程序和 api 没有问题。

任何想法如何使用 AWS ECS 使其工作？

Answer 1

如果您的部署没有捕获最新的镜像，可能是因为您的镜像引用缺少版本标签，例如 :latest ，例如:image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_web:latest .

我也看不到任何身份验证，但假设您的 (aws-)cli 已经对其进行了处理。

最后但并非最不重要的一点是，我发现这篇文章对从 GitLab 到 AWS ECS 和 ECR 非常有帮助，我知道这不完全是您的场景，但无论如何可能会有所帮助:http://www.devops-share.com/fully-automated-cicd-with-gitlab-and-aws-ecs/

HTH