Question

我正在尝试在AWS ECS（弹性容器服务）上运行的基于docker的应用上获取HTTPS证书。但是，当最终尝试将docker实例部署到ECS时，我遇到了一个未定义的问题。

INFO[0120] (service deploy) has started 1 tasks: (task f..........6).  timestamp=2018-03-21 14:52:17 +0000 UTC
FATA[0301] Deployment has not completed: Running count has not changed for 5.00 minutes

我的设置基于https://github.com/evertramos/docker-compose-letsencrypt-nginx-proxy-companion，他利用https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion

不幸的是，两者都没有为AWS ECS提供明确的示例。我添加的是let的加密容器的环境变量中的环境变量DOCKER_PROVIDER = ecs。在创建我的docker容器并将它们上传到ECS之后，我运行了一个特定于ecs的docker-compose

ecs-cli compose --file docker-compose_ec.yml service up

看起来像

version: '2'

services:
  nginx-web:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_nginx
    labels:
        com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: 
"true"
    container_name: ${NGINX_WEB}
    restart: always
    ports:
      - "$0.0.0.0:80:80"
      - "$0.0.0.0:443:443"
    volumes:
      - ${NGINX_FILES_PATH}/conf.d:/etc/nginx/conf.d
      - ${NGINX_FILES_PATH}/vhost.d:/etc/nginx/vhost.d
      - ${NGINX_FILES_PATH}/html:/usr/share/nginx/html
      - ${NGINX_FILES_PATH}/certs:/etc/nginx/certs:ro
      - ${NGINX_FILES_PATH}/htpasswd:/etc/nginx/htpasswd:ro
    logging:
      options:
        max-size: 4m
        max-file: 10
  nginx-gen:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_gen
    command: -notify-sighup ${NGINX_WEB} -watch -wait 5s:30s 
/etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf
   container_name: abc_gen
    restart: always
    volumes:
      - ${NGINX_FILES_PATH}/conf.d:/etc/nginx/conf.d
      - ${NGINX_FILES_PATH}/vhost.d:/etc/nginx/vhost.d
      - ${NGINX_FILES_PATH}/html:/usr/share/nginx/html
      - ${NGINX_FILES_PATH}/certs:/etc/nginx/certs:ro
      - ${NGINX_FILES_PATH}/htpasswd:/etc/nginx/htpasswd:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl:ro
    logging:
      options:
        max-size: 2m
        max-file: 10

  nginx-letsencrypt:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_le
    container_name: abc_le
    restart: always
    volumes:
      - ${NGINX_FILES_PATH}/conf.d:/etc/nginx/conf.d
      - ${NGINX_FILES_PATH}/vhost.d:/etc/nginx/vhost.d
      - ${NGINX_FILES_PATH}/html:/usr/share/nginx/html
      - ${NGINX_FILES_PATH}/certs:/etc/nginx/certs:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      NGINX_DOCKER_GEN_CONTAINER: abc_gen
      NGINX_PROXY_CONTAINER: abc_nginx
      DOCKER_PROVIDER: ecs
    logging:
      options:
        max-size: 2m
        max-file: 10
  api:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_api
    cpu_shares: 50
    mem_limit: 262144000
    ports:
      - '5005:5005' 
  web:
    image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_web
    cpu_shares: 100
    mem_limit: 262144000
    links:
      - api
    environment:
      - API_URL=http://api:5005
      - VIRTUAL_HOST=example.com
      - VIRTUAL_PORT=5000
      - LETSENCRYPT_HOST=example.com
      - LETSENCRYPT_EMAIL=mike@example.com

networks:
   default:
      external:
        name: ${NETWORK}

网络应用程序在端口5000上运行。运行Web应用程序和使用let加密的api时没有问题。

如何使用AWS ECS实现此功能？

Answer 1

如果您的部署未捕获最新图像，则可能是由于您的图片引用缺少版本标记，例如:latest，例如： image: 12344.dkr.ecr.eu-central-1.amazonaws.com/abc_web:latest。

我也看不到任何身份验证，但假设已经使用你的（aws-）cli进行了处理。

最后但并非最不重要的是，我发现这篇文章对于从GitLab开始使用AWS ECS和ECR非常有帮助，我知道这不完全符合您的情况，但无论如何都可以提供帮助：http://www.devops-share.com/fully-automated-cicd-with-gitlab-and-aws-ecs/

HTH

让我们在AWS ECS上加密docker nginx

1 个答案: