Question

我在docker-container中使用Nginx-proxy。我必须在服务器上运行多个应用程序。我想在一个除了一个之外的docker容器中运行它们。我在容器中运行Jira和Confluence。我花了很多时间来配置应用程序和Nginx-config。现在我想在服务器上运行Graylog2，我也面临着像Jira / Confluence那样的问题。我想这可能是因为我真的不明白这一切是如何运作的。这就是我制作以下图片的原因：

这就是我如何理解反向代理。 nginx-conf看起来像这样：

upstream jenkins {
  server 43.3.34.333:8080 fail_timeout=0;
}

upstream docker-jira {
    server jira:8080;
}

upstream docker-conf {
        server conf:8090;
}

upstream docker-graylog {
    server graylog:9000;
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;


    server_name mySite.de;
    return 301 https://mySite.de;
}


server {

    # SSL configuration

    listen 443 ssl http2 default_server;

    listen [::]:443 ssl http2 default_server;

    server_name mySite.de;

    include snippets/ssl-mySite.de;

    include snippets/ssl-params.conf;

    location /jenkins {
            proxy_set_header        Host $host:$server_port;
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        X-Forwarded-Proto $scheme;
            proxy_pass              http://jenkins;
            proxy_redirect      http://jenkins $scheme://mySite.de;
            # Required for new HTTP-based CLI
            proxy_http_version 1.1;
            proxy_request_buffering off;
            proxy_buffering off; # Required for HTTP-based CLI to work over SSL
            # workaround for https://issues.jenkins-ci.org/browse/JENKINS-45651
            add_header 'X-SSH-Endpoint' 'jenkins.domain.tld:50022' always;
            client_max_body_size 2M;
    }

    location /graylog {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Graylog-Server-URL http://$server_name/api;
        proxy_pass       http://docker-graylog/graylog;
    }

    location /jira {

        proxy_set_header X-Forwarded-Host $host;

        proxy_set_header X-Forwarded-Server $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://docker-jira/jira;

        client_max_body_size 100M;

        add_header X-Frame-Options ALLOW;

    }

    location /confluence {

        proxy_set_header X-Forwarded-Host $host;

        proxy_set_header X-Forwarded-Server $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://docker-conf/confluence;

        proxy_redirect http://docker-conf/confluence https://mySite.de;

        client_max_body_size 100M;

        add_header X-Frame-Options SAMEORIGIN;

    }

    location /synchrony {

        proxy_set_header X-Forwarded-Host $host;

        proxy_set_header X-Forwarded-Server $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://mySite.de:8091/synchrony;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "Upgrade";

        client_max_body_size 100M;

    }

}

要在代理后面运行Graylog2，您必须设置一些设置（Graylog2 docu）：

设置web_listen_uri
设置rest_listen_uri
设置web_endpoint_uri

我是这样做的：

rest_listen_uri = http://localhost:9000/api/
web_listen_uri = http://localhost:9000/graylog
GRAYLOG_WEB_ENDPOINT_URI：https://mySite.de/api

当我到达https://mySite.de/graylog时，我收到了502 Bad Gateway Error。 Nginx的日志：

connect() failed (111: Connection refused) while connecting to upstream, client: 33.11.102.157, server: mySite.de, request: "GET /graylog HTTP/2.0", upstream: "http://172.18.0.9:9000/graylog", host: "mySite.de"

我的网络：

NETWORK ID          NAME                   DRIVER              SCOPE
6c9de2d6b0ac        MyNet                   bridge              local

我真的不明白。

Answer 1

使用NGINX进行SSL终止，然后通过http发送到后端，保留80-> 443重定向。

更改这些以侦听LAN IP或docker DNS名称：

web_listen_uri = http://docker-graylog:9000/graylog
rest_listen_uri = http://docker-graylog:9000/api

注意：当前配置的问题在于它仅在本地主机上侦听，而外部传入的请求将永远不会进入应用程序，因为它没有侦听外部连接。它仅侦听Graylog容器内的连接。 NGINX无法通过局域网在localhost：9000上访问Graylog。

错误的网关表明您的代理服务器可能正在运行，但无法建立与应用程序的连接。

关于此的更多详细信息： https://forums.docker.com/t/access-to-localhost-from-bridge-network/22948/2

该配置基本上是您已经拥有的配置，但已从graylog文档中复制了该配置。您当前的代理配置可能会按原样工作。

upstream docker-graylog {
server graylog:9000;
}

server
{
listen      443 ssl spdy;
server_name mySite.de;
# <- your SSL Settings here!

location /graylog
{
  proxy_set_header Host $http_host;
  proxy_set_header X-Forwarded-Host $host;
  proxy_set_header X-Forwarded-Server $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Graylog-Server-URL https://$server_name/api;
  proxy_pass       http://docker-graylog/graylog;
}
}

理解与docker结合使用的反向代理

1 个答案: