为什么 https 不适用于我在 docker 中托管的网站？

Question

我有一个在 docker 中运行的站点，其中包含 4 个容器、一个反应前端、.net 后端、sql 数据库和 nginx 服务器。我的 docker compose 文件如下所示：

version: '3'
services:
  sssfe:
    image: mydockerhub:myimage-fe-1.3
    ports:
      - 9000:9000
    volumes:
      - sssfev:/usr/share/nginx/html
    depends_on:
      - sssapi
  sssapi:
    image: mydockerhub:myimage-api-1.3
    environment:
      - SQL_CONNECTION=myconnection
    ports:
      - 44384:44384
    depends_on:
      - jbdatabase
  jbdatabase:
    image: mcr.microsoft.com/mssql/server:2019-latest
    environment:
      - ACCEPT_EULA=Y
      - SA_PASSWORD=mypass
    volumes:
      - dbdata:/var/opt/mssql
    ports:
      - 1433:1433
  reverseproxy:
    build:
      context: ./nginx
      dockerfile: Dockerfile
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - example_certbot-etc:/etc/letsencrypt
    links :
      - sssfe
  certbot:
    depends_on:
      - reverseproxy
    image: certbot/certbot
    container_name: certbot
    volumes:
      - example_certbot-etc:/etc/letsencrypt
      - sssfev:/usr/share/nginx/html
    command: certonly --webroot --webroot-path=/usr/share/nginx/html --email myemail --agree-tos --no-eff-email --force-renewal -d example.com -d www.example.com    
volumes:
  example_certbot-etc:
    external: true
  dbdata:
  sssfev:

我正在关注this link，并且正在使用 cerbot 和letsencrypt 作为证书。我的 nginx 配置文件是这样的：

server {
        listen 80;
        listen [::]:80;

        server_name example.com www.example.com;


        location / {
                rewrite ^ https://$host$request_uri? permanent;

        }

        location ~ /.well-known/acme-challenge {
                allow all;
                root /usr/share/nginx/html;
        }
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        server_name example.com www.example.com;

        index index.html index.htm;

        root /usr/share/nginx/html;

        server_tokens off;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        include /etc/nginx/conf.d/options-ssl-nginx.conf;

        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
        # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        # enable strict transport security only if you understand the implications

        location = /favicon.ico {
                log_not_found off; access_log off;
        }
        location = /robots.txt {
                log_not_found off; access_log off; allow all;
        }
        location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ {
                expires max;
                log_not_found off;
        }
}

我的问题是 https 不适用于我的网站。当我点击https://example.com 时，我得到 ERR_CONNECTION_REFUSED。非 https 站点可以解析并且可以正常工作。无法弄清楚发生了什么。看起来 ssl 端口是打开的，并且 nginx 正在监听它：

 ss -tulpn | grep LISTEN    
tcp     LISTEN   0        128                    *:9000                 *:*      users:(("docker-proxy",pid=18336,fd=4))
tcp     LISTEN   0        128                    *:80                   *:*      users:(("docker-proxy",pid=18464,fd=4))
tcp     LISTEN   0        128                 [::]:22                [::]:*      users:(("sshd",pid=420,fd=4))
tcp     LISTEN   0        128                    *:1433                 *:*      users:(("docker-proxy",pid=18152,fd=4))
tcp     LISTEN   0        128                    *:443                  *:*      users:(("docker-proxy",pid=18452,fd=4))
tcp     LISTEN   0        128                    *:44384                *:*      users:(("docker-proxy",pid=18243,fd=4))

还有我的容器：

reverseproxy   0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp
sssfe          80/tcp, 0.0.0.0:9000->9000/tcp       
sssapi         0.0.0.0:44384->44384/tcp                   
database       0.0.0.0:1433->1433/tcp   

我假设这是我的 nginx 配置的问题，但我是新手，不知道从哪里开始。

Answer 1

如果您需要支持 SSL，请这样做：

mkdir /opt/docker/nginx/conf.d -p
touch /opt/docker/nginx/conf.d/nginx.conf
mkdir /opt/docker/nginx/cert -p

然后

vim /opt/docker/nginx/conf.d/nginx.conf

如果需要在访问http时强制重定向到https：

server {
    listen 443 ssl;
    server_name example.com www.example.com;  # domain
    # Pay attention to the file location, starting from /etc/nginx/ 
   
    ssl_certificate 1_www.example.com_bundle.crt;
    ssl_certificate_key 2_www.example.com.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;

    client_max_body_size 1024m;

    location / {
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        #Intranet address
        proxy_pass http://172.17.0.8:9090; #change it
    }
}
server {
     listen 80; 
     server_name example.com www.example.com;  # The domain name of the binding certificate
     #HTTP domain name request is converted to https
     return 301 https://$host$request_uri; 
}

docker run -itd --name nginx -p 80:80 -p 443:443 -v /opt/docker/nginx/conf.d/nginx.conf:/etc/nginx/conf.d/nginx.conf -v /opt/docker/nginx/cert:/etc/nginx -m 100m nginx

启动后输入docker ps查看是否启动成功

docker logs nginx 查看日志。