Traefik 无法路由到具有已发布端口的容器

Question

我正在尝试在 Docker Swarm 中的 Traefik 后面运行 GitLab。只要 GitLab 容器不发布任何端口，我就能成功地做到这一点。如果我发布一个端口（即用于 SSH），Traefik 在尝试路由到它时会给出网关超时。

我尝试在 Traefik 后面简单地运行一个裸 nginx 服务器，如果我在 nginx 容器中发布一些任意端口，Traefik 将不再能够路由到它 - 所以这不是 GitLab 容器特有的问题。

这是我的功能 docker-compose.yml：

version: "3.7"

services:
  socat:
    image: alpine/socat
    command: tcp-listen:2375,fork,reuseaddr unix-connect:/var/run/docker.sock
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - mgmt
    deploy:
      mode: global
      placement:
        constraints:
          - node.role == manager

  traefik:
    image: traefik:latest
    configs:
      - source: traefik
        target: /etc/traefik.toml
    command: --etcd --etcd.endpoint=stateful_etcd-1:2379,stateful_etcd-2:2379,stateful_etcd-3:2379 --etcd.useAPIV3
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    networks:
      - mgmt
      - gitlab
      - stateful_etcd
    deploy:
      replicas: 2
      placement:
        constraints:
          - node.role == worker
    depends_on:
      - socat

  gitlab:
    image: 'gitlab/gitlab-ce:latest'
    networks:
      - gitlab
    environment:
       GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://example.com'
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        gitlab_rails['gitlab_shell_ssh_port'] = 10022
        user['username'] = "root"
        user['group'] = "root"
    volumes:
      - test-gitlab-logs:/var/log/gitlab
      - test-gitlab-data:/var/opt/gitlab
    deploy:
      labels:
        traefik.docker.network: gitlab
        traefik.enable: "true"
        traefik.frontend.rule: "Host:example.com"
        traefik.port: 80
        traefik.protocol: http
      placement:
        constraints:
          - node.role == worker

networks:
  mgmt:
  gitlab:
  stateful_etcd:
    external: true

configs:
  traefik:
    file: ./traefik.toml

volumes:
  test-gitlab-logs:
    external: true
  test-gitlab-data:
    external: true

还有我的 traefik.toml：

debug = false

logLevel = "ERROR"
defaultEntryPoints = ["http", "https"]

[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
  [entryPoints.https.tls]

[api]
entrypoint = "traefik"
dashboard= true
debug = true

[retry]

[docker]
endpoint = "tcp://socat:2375"
watch = true
swarmMode = true
exposedByDefault = false

[etcd]
endpoint = "stateful_etcd-1:2379,stateful_etcd-2:2379,stateful_etcd-3:2379"
watch = true
prefix = "/traefik"
useAPIV3 = true

[acme]
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
email = "me@me.com"
storage = "traefik/acme/account"
entryPoint = "https"
onHostRule = true
[acme.httpChallenge]
entryPoint = "http"

仅供参考，我在另一个存储配置的堆栈中有 3 个 etcd 实例。

此设置有效 - 我可以转到 https://example.com 并访问 GitLab。但是，如果我将其添加到 GitLab 容器中：

ports:
  - 10022:22

当我转到 https://example.com 时出现网关超时。

这是预期的行为吗？有没有更好的方法来发布容器的 SSH 端口？

谢谢！

Answer 1

我无法直接解决该问题，但我可以通过将 SSH 代理作为单独的服务来解决该问题：

ssh-proxy:
    image: tecnativa/tcp-proxy
    networks:
      - gitlab
    ports:
      - 10022:10022
    environment:
      LISTEN: ":10022"
      TALK: "gitlab:22"