traefik - 将流量直接传递到容器以回答 Traefik 中的 LetsEncrypt 挑战

Question

我有一个容器('矩阵')，基于 https://github.com/silvio/docker-matrix (虽然这可能并不重要)。

它在端口 8448 和 3478(不是 80 或 443)上运行服务。

不运行 traefik，只运行 'matrix' 容器，在 'matrix' 容器内，我可以运行 LetsEncrypt 的 certbot，它请求告诉 LetsEncrypt 尝试在端口 443 上与我联系并提供 ssl 证书，如下所示:

certbot certonly --standalone --test-cert --email admin@amazing.site --agree-tos -d m.amazing.site

发起挑战，接受挑战，证书保存在容器的/etc/letsencrypt 目录中。

好的，现在我想在运行 Traefik 时执行此操作。

我在我的 docker-compose 文件中为这个容器传递了我的 Traefik 参数，如下所示:

labels:
  - "traefik.acme=false"
  - "traefik.enable=true"
  - "traefik.backend=matrix"
  - "traefik.frontend.rule=Host:m.amazing.site"
  - "traefik.port=443"
restart: always
expose:
 - 443
ports:
  - "8448:8448"
  - "3478:3478"

当我在容器中运行挑战时(与上面相同的命令)

certbot certonly --standalone --test-cert --email admin@amazing.site --agree-tos -d m.amazing.site

我在 Traefik 日志中得到以下信息

time="2017-07-14T01:04:35Z" level=error msg="Error getting cert: Cannot find challenge cert for domain b374a9118f855cacdb0096846a3dfa0c.f7c92b61d040f9ba250f14cc533ba4b8.acme.invalid, retrying in 453.949201ms" time="2017-07-14T01:04:35Z" level=error msg="Error getting cert: Cannot find challenge cert for domain b374a9118f855cacdb0096846a3dfa0c.f7c92b61d040f9ba250f14cc533ba4b8.acme.invalid, retrying in 808.788592ms" time="2017-07-14T01:04:36Z" level=error msg="Error getting cert: Cannot find challenge cert for domain b374a9118f855cacdb0096846a3dfa0c.f7c92b61d040f9ba250f14cc533ba4b8.acme.invalid, retrying in 1.138006833s" time="2017-07-14T01:04:37Z" level=error msg="Error getting cert: Cannot find challenge cert for domain b374a9118f855cacdb0096846a3dfa0c.f7c92b61d040f9ba250f14cc533ba4b8.acme.invalid, retrying in 2.436785791s" time="2017-07-14T01:04:40Z" level=error msg="Error getting cert: Cannot find challenge cert for domain b374a9118f855cacdb0096846a3dfa0c.f7c92b61d040f9ba250f14cc533ba4b8.acme.invalid, retrying in 3.055167113s" time="2017-07-14T01:04:43Z" level=error msg="Error getting cert: Cannot find challenge cert for domain b374a9118f855cacdb0096846a3dfa0c.f7c92b61d040f9ba250f14cc533ba4b8.acme.invalid, retrying in 4.856677044s" time="2017-07-14T01:04:48Z" level=error msg="Error getting cert: Cannot find challenge cert for domain b374a9118f855cacdb0096846a3dfa0c.f7c92b61d040f9ba250f14cc533ba4b8.acme.invalid, retrying in 7.544878611s" time="2017-07-14T01:04:55Z" level=error msg="Error getting cert: Cannot find challenge cert for domain b374a9118f855cacdb0096846a3dfa0c.f7c92b61d040f9ba250f14cc533ba4b8.acme.invalid, retrying in 6.313970727s" time="2017-07-14T01:05:01Z" level=error msg="Error getting cert: Cannot find challenge cert for domain 8b1e27af665c4676b47236f25c3ccc73.1313b1cc8ceaaa7467ba2e5845c08fde.acme.invalid" time="2017-07-14T01:05:01Z" level=debug msg="ACME got nothing 8b1e27af665c4676b47236f25c3ccc73.1313b1cc8ceaaa7467ba2e5845c08fde.acme.invalid" 2017/07/14 01:05:01 server.go:2753: http: TLS handshake error from 66.133.109.36:55264: EOF

请注意，这些是真实日志。没有提及我试图验证的实际域名。

我究竟做错了什么？

Answer 1

您不能立即为特定主机禁用 acme，因为 acme 安装了在所有规则之前执行的路由。

我想出了一个方法来解决这个问题:

https://gist.github.com/micw/67faf5cd3d4a6f64568ca2bb9a051230

此致，
迈克尔。