Traefik 和 https 私有存储库 - tls 错误

Question

我正在尝试在我的 docker swarm 上部署一个私有存储库。 我正在关注official docker repository guide 将其部署为服务。我希望能够通过 https 使用它，从外部通过一个简单的 url 作为https://myregistry.mysite.com。

为此，我在堆栈 yml 文件中使用以下 traefik 标签：

traefik.backend: "privateregistry"
traefik.docker.network: "webgateway" # docker overlay external
traefik.enable: "true"
traefik.frontend.entryPoint: "https"
traefik.frontend.redirect.entryPoint: "https"
traefik.frontend.rule: "Host:myregistry.mysite.com"
traefik.port: "5000"

我在 traefik UI 中看到我的两个前端/后端，但是当我访问 https://myregistry.mysite.com/v2/（例如）时，我遇到了 500 个致命错误。服务日志输出是 http: TLS handshake error from 10.0.0.68:47796: tls: first record does not look like a TLS handshake

我想我误解了一些东西，可能是证书方面。

有没有办法做到这一点而不会出错？

谢谢

Answer 1

我想您缺少客户端计算机上的（注册表）服务器的证书。我假设您有两个证书文件（在服务器上使用）：

• myregistry.mysite.com.crt
• myregistry.mysite.com.key

将客户端计算机上的 myregistry.mysite.com.crt 复制到 Linux 上的 /etc/docker/certs.d/myregistry.mysite.com/ca.crt 或 ~/.docker/certs.d/myregistry.mysite.com/ca.crt 在 Mac 上。现在您应该可以从客户端登录了：

docker login myregistry.mysite.com

---

附录 - 服务器设置

您的服务器设置可能如下所示：

~/certs/myregistry.mysite.com.crt
~/certs/myregistry.mysite.com.key
~/docker-compose.yml
~/traefik.toml

docker-compose.yml

version: '3'

services:
  frontproxy:
    image: traefik
    command: --api --docker --docker.swarmmode
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./certs:/etc/ssl:ro
      - ./traefik.toml:/etc/traefik/traefik.toml:ro
      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
  docker-registry:
    image: registry:2
    deploy:
      labels:
        - traefik.port=5000 # default port exposed by the registry
        - traefik.frontend.rule=Host:myregistry.mysite.com

traefik.toml

defaultEntryPoints = ["http", "https"]

# Redirect HTTP to HTTPS and use certificate, see https://docs.traefik.io/configuration/entrypoints/
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      certFile = "/etc/ssl/myregistry.mysite.com.crt"
      keyFile = "/etc/ssl/myregistry.mysite.com.key"

# Docker Swarm Mode Provider, see https://docs.traefik.io/configuration/backends/docker/#docker-swarm-mode
[docker]
endpoint = "tcp://127.0.0.1:2375"
domain = "docker.localhost"
watch = true
swarmMode = true

部署您的注册表运行：

docker stack deploy myregistry -c ~/docker-compose.yml