nginx 和 docker - 将端口 80/443 转发到 3000

Question

我正在使用 docker-compose 为我的应用配置一个 meteor 应用容器和一个 nginx 容器，这是我的 docker-compose 文件：

version: '2'
services:
  webapp:
    image: webapp.image.uri:latest
    ports:
     - "3000:3000"
    environment:
     - ROOT_URL=https://my.app.url
  nginx:
    image: nginx.image.uri:latest
    volumes:
      - certs:/etc/letsencrypt
      - certs-data:/data/letsencrypt
    ports:
     - "80:80"
     - "443:443"

我正在使用nginx 处理 HTTPS 请求。 我想要做的是配置nginx，以便当用户访问my.app.url 时，我可以让meteor 应用程序（端口3000）在端口443 上工作。
顺便说一句，这是我正在使用的 nginx 配置：

server {
    listen      80;
    listen [::]:80;
    server_name my.app.url;

    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }

    location ^~ /.well-known {
        allow all;
        root  /data/letsencrypt/;
    }
}

server {
    listen      443           ssl http2;
    listen [::]:443           ssl http2;
    server_name               my.app.url;

    ssl                       on;

    add_header                Strict-Transport-Security "max-age=31536000" always;

    ssl_session_cache         shared:SSL:20m;
    ssl_session_timeout       10m;

    ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers               "ECDH+AESGCM:ECDH+AES256:ECDH+AES128:!ADH:!AECDH:!MD5;";

    ssl_stapling              on;
    ssl_stapling_verify       on;
    resolver                  8.8.8.8 8.8.4.4;

    ssl_certificate           /etc/letsencrypt/live/my.app.url/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/my.app.url/privkey.pem;
    ssl_trusted_certificate   /etc/letsencrypt/live/my.app.url/chain.pem;

    access_log                /dev/stdout;
    error_log                 /dev/stderr info;

    # other configs
}

非常感谢！

Answer 1

我让它工作了。这就是我修改docker-compose.yml 文件的方式：

version: '2'
services:
  webapp:
    image: webapp.image.uri:latest
    ports:
     - "3000:3000"
    environment:
     - ROOT_URL=https://my.app.url
  nginx:
    image: nginx.image.uri:latest
    volumes:
      - certs:/etc/letsencrypt
      - certs-data:/data/letsencrypt
    ports:
     - "80:80"
     - "443:443"
    links:  # new
     - webapp
    volumes_from:
     - webapp

这是nginx 配置文件：

server {
    listen      80;
    listen [::]:80;
    server_name my.app.url;

    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }

    location ^~ /.well-known {
        allow all;
        root  /data/letsencrypt/;
    }
}

server {
    listen      443           ssl http2;
    listen [::]:443           ssl http2;
    server_name               my.app.url;

    ssl                       on;

    add_header                Strict-Transport-Security "max-age=31536000" always;

    ssl_session_cache         shared:SSL:20m;
    ssl_session_timeout       10m;

    ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers               "ECDH+AESGCM:ECDH+AES256:ECDH+AES128:!ADH:!AECDH:!MD5;";

    ssl_stapling              on;
    ssl_stapling_verify       on;
    resolver                  8.8.8.8 8.8.4.4;

    ssl_certificate           /etc/letsencrypt/live/my.app.url/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/my.app.url/privkey.pem;
    ssl_trusted_certificate   /etc/letsencrypt/live/my.app.url/chain.pem;

    access_log                /dev/stdout;
    error_log                 /dev/stderr info;

    # other configs

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect    off;
        proxy_pass         http://webapp:3000;
    }
}

Answer 2

我要做的是配置 nginx，以便当用户访问 my.app.url 时，我可以让流星应用程序在端口 443 上运行

您可以使用 nginx_http_rewrite_module 将 http 永久重定向到 https。 将您的第一个服务器块更改为：

server {
  listen      80;
  listen [::]:80;
  server_name my.app.url;
  return 301 https://my.app.url$request_uri;
}

更多的nginx_http_rewrite_module你可以参考这个http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return

关于端口转发，假设你的应用服务器监听 3000 端口，你可以在 http 块中添加一个上游块。

upstream app {
    server 127.0.0.1:3000; #image the nginx is in same machine with your app server
}

并将此行添加到您的第二个服务器块：

proxy_pass https://app;

现在来自外部的所有连接都将是 https 并且您在端口 3000 上侦听的应用也可以处理来自 443 的请求。