nginx 作为多个域和多个容器的反向代理

Question

我有 nginx、certbot 和 spring boot 应用程序，它们都作为 docker 容器运行，并在一个 docker-compose.yml 中配置。

我使用以下 nginx.conf：

server {
    listen 80;
    listen [::]:80;
    server_name sub1.domain.de;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name sub1.domain.de;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/sub1.domain.de/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sub1.domain.de/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    location / {
        proxy_pass http://container1:8080;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
  add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
        #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        # enable strict transport security only if you understand the implications
    }

    root /var/www/html;
       index index.html index.htm index.nginx-debian.html;
   }




server {
    listen 80;
    listen [::]:80;
    server_name sub2.domain.de;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}


server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name sub2.domain.de;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/sub1.domain.de/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sub1.domain.de/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    location / {
        proxy_pass http://bcontainer2:8081;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
        #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        # enable strict transport security only if you understand the implications
    }

    root /var/www/html;
       index index.html index.htm index.nginx-debian.html;
   }

SSL 证书适用于两个域，但名称与第一个域相同。
当尝试访问 sub1.domain.de 时，我收到 502，错误的网关。我在这里缺少什么？
不过我可以通过 ip-adress:8081 到达我的container2。

预先感谢您的帮助！

Answer 1

如果有人遇到同样的麻烦，这是我的解决方案，对我来说效果很好：

在 docker-compose.yml 中，您必须将容器映射到不同的端口。这就是我已经做的，你可以在我的第一篇文章中查看该文件。所以这个文件保持不变。

在 nginx.conf 中，您必须使用对应的 intern 端口来寻址容器。这意味着在我的情况下（两个容器，都在内部监听端口 8080），在这两种情况下 proxy_pass 都必须指向“container_name:8080”。我一开始以为一定是主机端口，事实并非如此。

nginx.conf：

server {
    listen 80;
    listen [::]:80;
    server_name sub1.domain.de;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name sub1.domain.de;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/sub1.domain.de/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sub1.domain.de/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    location / {
        proxy_pass http://container1:8080;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
  add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
        #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        # enable strict transport security only if you understand the implications
    }

    root /var/www/html;
       index index.html index.htm index.nginx-debian.html;
   }




server {
    listen 80;
    listen [::]:80;
    server_name sub2.domain.de;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}


server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name sub2.domain.de;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/sub1.domain.de/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sub1.domain.de/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    location / {
        proxy_pass http://bcontainer2:8080;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
        #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        # enable strict transport security only if you understand the implications
    }

    root /var/www/html;
       index index.html index.htm index.nginx-debian.html;
   }