nginx通过docker - 错误：1408F10B：SSL例程：ssl3_get_record：错误的版本号答案

【问题标题】：nginx via docker - error:1408F10B:SSL routines:ssl3_get_record:wrong version numbernginx通过docker - 错误：1408F10B：SSL例程：ssl3_get_record：错误的版本号
【发布时间】：2021-06-01 06:11:45
【问题描述】：

我通过 docker 设置了一个协作服务器。我想把它放在代理后面，这样它只能通过 https 访问：

我已关注文档 here 和 here。

在第二个链接上，我正在使用设置选项 2 of 3。我不确定是否应该使用选项 1。

运行容器后，我想根据上面第一个文档链接的底部检查协作服务器是否正在运行。获得“OK”消息表示一切设置正确：

curl -k https://localhost:9980
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

如果我删除 s:

curl -k http://localhost:9980
OK

我在 docker-compose 中有 3 个服务，这是日志的最后几行：

docker ps
CONTAINER ID   IMAGE               COMMAND                  CREATED       STATUS       PORTS                                      NAMES
ee6bdb68f8e2   collabora/code      "/bin/sh -c 'bash st…"   2 hours ago   Up 2 hours   0.0.0.0:9980->9980/tcp                     collabora
1488465463c6   nginx:1.15-alpine   "/bin/sh -c 'while :…"   2 hours ago   Up 2 hours   0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp   collabora_nginx_1
4361ed3f6df7   certbot/certbot     "/bin/sh -c 'trap ex…"   2 hours ago   Up 2 hours   80/tcp, 443/tcp                            collabora_certbot_1

collabora 服务器容器/服务：

docker logs collabora
wsd-00006-00042 2021-03-02 16:39:07.374169 [ websrv_poll ] WRN  convert-to: Requesting address is denied: ::ffff:168.119.3.73| wsd/LOOLWSD.cpp:2315
wsd-00006-00042 2021-03-02 16:40:10.725982 [ websrv_poll ] ERR  Looks like SSL/TLS traffic on plain http port| wsd/LOOLWSD.cpp:2383

nginx 容器/服务：

docker logs collabora_nginx_1
2021/03/02 16:49:47 [error] 10#10: *54 open() "/etc/nginx/html/robots.txt" failed (2: No such file or directory), client: 198.20.87.98, server: collabora.mydomain.de, request: "GET /robots.txt HTTP/1.1", host: "135.181.152.187"
198.20.87.98 - - [02/Mar/2021:16:49:47 +0000] "GET /robots.txt HTTP/1.1" 404 154 "-" "-" "-"
2021/03/02 16:49:48 [error] 10#10: *55 open() "/etc/nginx/html/sitemap.xml" failed (2: No such file or directory), client: 198.20.87.98, server: collabora.mydomain.de, request: "GET /sitemap.xml HTTP/1.1", host: "135.181.152.187"
198.20.87.98 - - [02/Mar/2021:16:49:48 +0000] "GET /sitemap.xml HTTP/1.1" 404 154 "-" "-" "-"
2021/03/02 16:49:50 [error] 10#10: *56 open() "/etc/nginx/html/.well-known/security.txt" failed (2: No such file or directory), client: 198.20.87.98, server: collabora.mydomain.de, request: "GET /.well-known/security.txt HTTP/1.1", host: "135.181.152.187"
198.20.87.98 - - [02/Mar/2021:16:49:50 +0000] "GET /.well-known/security.txt HTTP/1.1" 404 154 "-" "-" "-"
2021/03/02 16:49:51 [error] 10#10: *57 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 198.20.87.98, server: collabora.mydomain.de, request: "GET /favicon.ico HTTP/1.1", host: "135.181.152.187"
198.20.87.98 - - [02/Mar/2021:16:49:51 +0000] "GET /favicon.ico HTTP/1.1" 404 154 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0" "-"
2021/03/02 16:49:56 [error] 10#10: *62 "/etc/nginx/html/index.html" is not found (2: No such file or directory), client: 104.155.101.3, server: collabora.mydomain.de, request: "GET / HTTP/1.1", host: "135.181.152.187"
104.155.101.3 - - [02/Mar/2021:16:49:56 +0000] "GET / HTTP/1.1" 404 154 "-" "python-requests/2.25.1" "-"

certbot 容器：

docker logs collabora_certbot_1
logs collabora_certbot_1 
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/collabora.mydomain.de.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
  /etc/letsencrypt/live/collabora.mydomain.de/fullchain.pem expires on 2021-05-31 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

我的 docker-compose.yaml：

version: "3.5"
services:
  collabora:
    image: collabora/code
    container_name: collabora
    restart: always
    depends_on:
      - nginx
    cap_add:
      - MKNOD
    environment:
      - "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
      - domain=nx12345\.blah\.de
      - dictionaries=en_US
    ports:
      - "9980:9980"
    volumes:
      - ./appdata/collabora:/config    
  nginx:
    image: nginx:1.15-alpine
    restart: unless-stopped
    volumes:
      - ./data/nginx:/etc/nginx/conf.d
      - ./data/certbot/conf:/etc/letsencrypt
      - ./data/certbot/www:/var/www/certbot
    ports:
      - "80:80"
      - "443:443"
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
  certbot:
    image: certbot/certbot
    restart: unless-stopped
    volumes:
      - ./data/certbot/conf:/etc/letsencrypt
      - ./data/certbot/www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

我的 nginx 配置 app.conf：

server {
    listen 80;
    server_name mydomain.de;
    server_tokens off;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}


server {
    listen       443 ssl;
    server_name  collabora.mydomain.de;

    ssl_certificate /etc/letsencrypt/live/collabora.mydomain.de/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/collabora.mydomain.de/privkey.pem;
    
    # static files
    location ^~ /loleaflet {
        proxy_pass http://localhost:9980;
        proxy_set_header Host $http_host;
    }

    # WOPI discovery URL
    location ^~ /hosting/discovery {
        proxy_pass http://localhost:9980;
        proxy_set_header Host $http_host;
    }

    # Capabilities
    location ^~ /hosting/capabilities {
        proxy_pass http://localhost:9980;
        proxy_set_header Host $http_host;
    }

    # main websocket
    location ~ ^/lool/(.*)/ws$ {
        proxy_pass http://localhost:9980;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $http_host;
        proxy_read_timeout 36000s;
    }

    # download, presentation and image upload
    location ~ ^/lool {
        proxy_pass http://localhost:9980;
        proxy_set_header Host $http_host;
    }

    # Admin Console websocket
    location ^~ /lool/adminws {
        proxy_pass http://localhost:9980;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $http_host;
        proxy_read_timeout 36000s;
    }
}

如何按照上述使用 docker 的设置，使用 nginx 将协作服务器正确放置在代理后面？

【问题讨论】：

标签： docker nginx ssl docker-compose

【解决方案1】：

proxy_pass http://localhost:9980

在您的 nginx.conf 中，localhost 指的是 nginx 容器本身。如果您尝试路由到 collabora 容器，请将“localhost”更改为 collabora 容器的名称，collabora。

Refer to this post about localhost in docker-compose

【讨论】：

您好，感谢您提供的信息。 localhost:9980 在我的 nginx conf 中被引用了 5 次，你的意思是每次都更改？喜欢这个http://collabora:9980 还是只是collabora？
我尝试将它们全部更改为http://collabora:9980，但在重建并运行“curl: (35) error:1408F10B:SSLroutines:ssl3_get_record:wrong version number”后收到与标题相同的错误
它确实适用于mydomain.de:9980，但它只是 ssl 部分
另一条信息是我可以访问collabora.mydomain.de。如果我设置正确，它将自动重定向到 https 版本

【解决方案2】：

问题是网络。一个我还没有完全理解的概念，但是将它添加到我的 docker-compose 中就可以了：

networks:
  collabora:

然后在每个服务中我都引用了同一个网络。

【讨论】：