docker - 如何通过 Docker Compose 在 RabbitMQ 上使用 SSL？

Question

我正在使用这个 docker-compose.yml 在 Docker 上运行 RabbitMQ 实例，没问题，它正在工作:

version: '3.7'
services:
  my-rabbit:
    image: imageAddress
    hostname: my-rabbit
    ports:
      - "5672:5672"
      - "15672:15672"
    networks:
      - testNetwork
networks:
  testNetwork:
    external: true

但我必须使用带有证书的 RabbitMQ 才能通过 TLS 获得连接。
我尝试过这种方式，并且 certs 文件夹包含证书但出现错误:

version: '3.7'
services:
  my-rabbit:
    tty: true
    image: imageAddress
    environment:
      - RABBITMQ_SSL_CERTFILE=/cert_rabbitmq/testca/cacert.pem
      - RABBITMQ_SSL_KEYFILE=/cert_rabbitmq/server/cert.pem
      - RABBITMQ_SSL_CACERTFILE=/cert_rabbitmq/server/key.pem
    hostname: my-rabbit
    ports:
      - "5672:5672"
      - "15672:15672"
    volumes:
      - /home/ilkaygunel/Desktop/certs:/cert_rabbitmq
    networks:
      - testNetwork
networks:
  testNetwork:
    external: true

错误如下所示。它说旧式配置文件存在，但我不知道该怎么做。

my-rabbit_1  | error: Docker configuration environment variables specified, but old-style (Erlang syntax) configuration file '/etc/rabbitmq/rabbitmq.config' exists
my-rabbit_1  |   Suggested fixes: (choose one)
my-rabbit_1  |    - remove '/etc/rabbitmq/rabbitmq.config'
my-rabbit_1  |    - remove any Docker-specific 'RABBITMQ_...' environment variables
my-rabbit_1  |    - convert '/etc/rabbitmq/rabbitmq.config' to the newer sysctl format ('/etc/rabbitmq/rabbitmq.conf'); see https://www.rabbitmq.com/configure.html#config-file

我应该怎么做才能使用该证书文件？

Answer 1

尝试这样的事情。此外，您似乎指向了错误的文件。证书文件应该是 cert.pem , key 文件应该是 key.pem cacertfile 应该是 cacert或者如果你想像你一样使用 3.7，它应该是:-

version: '3.7'
services:
  my-rabbit:
    tty: true
    image: imageAddress
    environment:
      - RABBITMQ_SSL_CERTFILE=/cert_rabbitmq/testca/cert.pem
      - RABBITMQ_SSL_KEYFILE=/cert_rabbitmq/server/key.pem
      - RABBITMQ_SSL_CACERTFILE=/cert_rabbitmq/server/cacert.pem
    hostname: my-rabbit
    ports:
      - "5672:5672"
      - "15672:15672"
    volumes:
      - /home/ilkaygunel/Desktop/certs:/cert_rabbitmq
    networks:
      - testNetwork
networks:
  testNetwork:
    external: true

或者，只需使用新格式设置一个 rabbitmq 配置文件，如下所示:-

#A new style format snippet. This format is used by rabbitmq.conf files.
ssl_options.cacertfile           = /path/to/ca_certificate.pem
ssl_options.certfile             = /path/to/server_certificate.pem
ssl_options.keyfile              = /path/to/server_key.pem
ssl_options.verify               = verify_peer
ssl_options.fail_if_no_peer_cert = true

从文档中看起来，使用这种配置格式，你甚至可能不需要在你的 docker compose 文件中使用 RABBITMQ... 风格的环境变量。