docker - 反向代理无法加载 ssl 证书

Question

我正在尝试在 docker 容器中运行 nginx 代理，并与生成和更新证书的letsencrypt容器耦合。
不启用 ssl 配置运行良好
启用 ssl 我收到以下错误

emerg] 1#1: cannot load certificate "/etc/ssl/private/fullchain.pem":BIO_new_file() failed (SSL: error:02001002:system library:fopen:Nosuch file or directory:fopen('/etc/ssl/private/fullchain.pem','r')error:2006D080:BIO routines:BIO_new_file:no such file) reverse_proxy
| nginx: [emerg] cannot load certificate"/etc/ssl/private/fullchain.pem": BIO_new_file() failed (SSL:error:02001002:system library:fopen:No such file ordirectory:fopen('/etc/ssl/private/fullchain.pem','r')error:2006D080:BIO routines:BIO_new_file:no such file)

以下是我的配置
/conf.d/sites-avaidable/heimdall.conf

  upstream heimdall {
  server        192.168.178.215:8888;
}

server {
  listen        443 ssl;
  #listen       80;
  server_name   heimdall.domain.tld;

   include      common.conf;
   include      /etc/nginx/ssl.conf;

  location / {
    proxy_pass  http://192.168.178.215:8888;
    include     common_location.conf;

  }
}

从/etc/nginx
nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/sites-enabled/*.conf;
}

common.conf

add_header Strict-Transport-Security    "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options              SAMEORIGIN;
add_header X-Content-Type-Options       nosniff;
add_header X-XSS-Protection             "1; mode=block";

common_location.conf

proxy_set_header    X-Real-IP           $remote_addr;
proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
proxy_set_header    X-Forwarded-Proto   $scheme;
proxy_set_header    Host                $host;
proxy_set_header    X-Forwarded-Host    $host;
proxy_set_header    X-Forwarded-Port    $server_port;

ssl.conf

ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
ssl_ecdh_curve              secp384r1;
ssl_ciphers                 "ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384 OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 OLD_TLS_ECDHE_RSA_WITH_CH$
ssl_prefer_server_ciphers   on;
ssl_dhparam                 /etc/nginx/dhparams.pem;
ssl_certificate             /etc/ssl/private/fullchain.pem;
ssl_certificate_key         /etc/ssl/private/privkey.pem;
ssl_session_timeout         10m;
ssl_session_cache           shared:SSL:10m;
ssl_session_tickets         off;
ssl_stapling                on;
ssl_stapling_verify         on;

/etc/ssl/private 充满了证书的符号链接(symbolic link)，这些证书由另一个 docker 容器生成。
直接安装目录会导致完全相同的行为。
这是安装在/etc/ssl/private 的文件夹

total 28
drwxr-xr-x 2 pi pi 4096 juin  22 20:19 .
drwxr-xr-x 4 pi pi 4096 juin  22 22:39 ..
lrwxrwxrwx 1 pi pi   69 juin  22 20:19 cert.pem -> /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/cert.pem
lrwxrwxrwx 1 pi pi   70 juin  22 20:19 chain.pem -> /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/chain.pem
lrwxrwxrwx 1 pi pi   74 juin  22 20:19 fullchain.pem -> /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/fullchain.pem
lrwxrwxrwx 1 pi pi   72 juin  22 20:19 privkey.pem -> /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/privkey.pem
lrwxrwxrwx 1 pi pi   67 juin  22 20:19 README -> /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/README

这是符号链接(symbolic link)目标文件夹

total 12
drwxr-xr-x 2 pi pi 4096 juin  22 16:03 .
drwx------ 4 pi pi 4096 juin  22 16:23 ..
lrwxrwxrwx 1 pi pi   35 juin  22 16:03 cert.pem -> ../../archive/site.tld/cert1.pem
lrwxrwxrwx 1 pi pi   36 juin  22 16:03 chain.pem -> ../../archive/site.tld/chain1.pem
lrwxrwxrwx 1 pi pi   40 juin  22 16:03 fullchain.pem -> ../../archive/site.tld/fullchain1.pem
lrwxrwxrwx 1 pi pi   38 juin  22 16:03 privkey.pem -> ../../archive/site.tld/privkey1.pem
-rw-r--r-- 1 pi pi  692 juin  22 16:03 README

这是来自容器内终端的 ls -la

root@reverse_proxy:/etc/ssl/private# ls -la
total 12
drwxr-xr-x 2 1000 1000 4096 Jun 22 14:03 .
drwxr-xr-x 4 root root 4096 Jun  9 05:06 ..
-rw-r--r-- 1 1000 1000  692 Jun 22 14:03 README
lrwxrwxrwx 1 1000 1000   35 Jun 22 14:03 cert.pem -> ../../archive/site.tld/cert1.pem
lrwxrwxrwx 1 1000 1000   36 Jun 22 14:03 chain.pem -> ../../archive/site.tld/chain1.pem
lrwxrwxrwx 1 1000 1000   40 Jun 22 14:03 fullchain.pem -> ../../archive/site.tld/fullchain1.pem
lrwxrwxrwx 1 1000 1000   38 Jun 22 14:03 privkey.pem -> ../../archive/site.tld/privkey1.pem

我确实希望有人能指出我正确的方向
我搜索和搜索，重新生成了我的 dhparams.pem，但我发现似乎没有解决我的问题。

Answer 1

我在尝试使用 Nginx 构建 Nexus 部署时遇到了同样的问题。容器无法遍历 ssl.conf 中的符号链接(symbolic link)，因为您指向 letencrypt key 的指针来自 live --> 存档。
要解决此问题，您不能只更改指向存档的指针，因为文件如chain.pem -> ../../archive/site.tld/chain1.pem我可以让它工作的唯一方法是不指向符号链接(symbolic link)，而是指向磁盘上的实际文件。注意 1在与磁盘上的内容匹配的文件名中。
我的/etc/ssl/private

ssl_certificate /etc/ssl/private/fullchain1.pem;
ssl_certificate_key /etc/ssl/private/privkey1.pem;
ssl_trusted_certificate /etc/ssl/private/chain1.pem;
ssl_dhparam /etc/nginx/dhparams.pem;

所以在我的 docker-compose.yml你可以看到我挂载卷

    volumes:
      - /etc/letsencrypt/archive/example.site.com:/etc/ssl/private

我相信有一种更优雅的方法，但这是我可以让它工作的唯一方法。