Question

我尝试在一台主机上运行三个docker容器。 Traaefik是代理其他容器流量的容器之一。

我的第一个目标是通过端口80上的专用主机名访问每个容器.Traefik ui应仅通过主机名和端口80可用，具有某种身份验证。

只使用docker-compose.yml，我可以使用主机名到达所有三个容器，所有这些都在端口80上。但是为了添加身份验证，我想我需要引入一个traefik.toml。但这给我带来了麻烦。下一个目标是在所有三个主机上使用let加密来引入SSL。但首先要做的事情是......

具有三台主机的工作解决方案，全部在端口80上，缺少Traefik UI的授权：

version: "2"

networks:
 web:

services:

 prox:
    image: containous/traefik:latest # The official Traefik docker image
    command: --api --docker # Enables the web UI and tells Træfik to listen to docker
    restart: unless-stopped
    ports:
      - "80:80"     # The HTTP port
    labels:
      - "traefik.port=8080"
      - "traefik.backend=traefikception"
      - "traefik.frontend.rule=Host:traefik.test.com"
      - "traefik.enable=true"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
    networks:
      - web

 seafile_1:
    image: seafileltd/seafile
    container_name: seafile_1
    restart: unless-stopped
    environment:
      SEAFILE_ADMIN_EMAIL: me@test.com
      SEAFILE_ADMIN_PASSWORD: ####
      SEAFILE_SERVER_HOSTNAME: 1.test.com
    labels:
      - traefik.enable=true
      - traefik.frontend.rule=Host:1.test.com
      - traefik.port=80
      - traefik.backend=seafile_1
      - traefik.docker.network=web
    volumes:
      - /opt/seafile-data/ttt_1:/shared
    networks:
      - web

 seafile_2:
    image: seafileltd/seafile
    container_name: seafile_2
    restart: unless-stopped
    environment:
      SEAFILE_ADMIN_EMAIL: me@test2.com
      SEAFILE_ADMIN_PASSWORD: #####
      SEAFILE_SERVER_HOSTNAME: 2.test2.com
    labels:
      - traefik.enable=true
      - traefik.frontend.rule=Host:2.test2.com
      - traefik.port=80
      - traefik.backend=seafile_1
      - traefik.docker.network=web
    volumes:
      - /opt/seafile-data/ttt_2:/shared
    networks:
      - web

添加以下traefik.toml：

defaultEntryPoints = ["http"]

[entryPoints]
  [entryPoints.http]
  address = ":80"

 [entryPoints.proxy]
   address=":80"
   [entryPoints.proxy.auth]
     [entryPoints.proxy.auth.basic]
       users = [
         "joh:$apr1$RKdHyOKO$QDK1EKB4UJbsda7CXfPfK0",
       ]

[api]
entrypoint="proxy"

我在日志中遇到以下错误，没有任何容器可以从外部访问：

prox_1           | time="2018-06-17T19:23:26Z" level=fatal msg="Error preparing server: listen tcp :8080: bind: address already in use"
prox_1           | time="2018-06-17T19:24:26Z" level=error msg="Error opening listener listen tcp :8080: bind: address already in use"
prox_1           | time="2018-06-17T19:24:26Z" level=fatal msg="Error preparing server: listen tcp :8080: bind: address already in use"

我很确定我需要调整我的docker-compose.yml并将设置移动到traefik.toml，但我无法理解如何去做。

提前致谢!!

Answer 1

在traefik支持松弛的帮助下，我能够解决这个问题。

每个端口可能没有多个entryPoint
可以在docker-compose.yml
添加acme.json并配置https，让我们只在traefik.toml加密

在/ opt / traefik中输入以下三个文件：

<强> acme.json：

可能是空的但必须妥善保管：

touch acme.json
chmod 600 acme.json

<强>搬运工-compose.yml：

version: "2"

networks:
 web:

services:

 prox:
    image: containous/traefik:latest # The official Traefik docker image
    command: --api --docker # Enables the web UI and tells Træfik to listen to docker
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
#     - "8080:8080" # Don't want this port open (on all hostnames!)
    labels:
      - "traefik.port=8080"
      - "traefik.backend=traefikception"
      - "traefik.frontend.rule=Host:traefik.example.me"
      - "traefik.enable=true"
      - "traefik.frontend.auth.basic=admin:$$ert2$$RKdHyOKO$$QDK1EKB4UJbsda7CXfPfK0"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock" # So that Traefik can listen to the Docker events
      - "./traefik.toml:/traefik.toml"
      - "./acme.json:/acme.json"
    networks:
      - web

seafile_org1:
    image: seafileltd/seafile
    container_name: seafile_org1
    restart: unless-stopped
    environment:
      SEAFILE_ADMIN_EMAIL: mail@mail.me
      SEAFILE_ADMIN_PASSWORD: ####
      SEAFILE_SERVER_HOSTNAME: org1.example.me
    labels:
      - traefik.enable=true
      - traefik.frontend.rule=Host:org1.example.me
      - traefik.port=80
      - traefik.backend=seafile_org1
      - traefik.docker.network=web
    volumes:
      - /opt/seafile-data/org1:/shared
    networks:
      - web

 seafile_org2:
    image: seafileltd/seafile
    container_name: seafile_org2
    restart: unless-stopped
    environment:
      SEAFILE_ADMIN_EMAIL: mail@mail.com
      SEAFILE_ADMIN_PASSWORD: ####
      SEAFILE_SERVER_HOSTNAME: org2.example.com
    labels:
      - traefik.enable=true
      - traefik.frontend.rule=Host:org2.example.com
      - traefik.port=80
      - traefik.backend=seafile_org2
      - traefik.docker.network=web
    volumes:
      - /opt/seafile-data/org2:/shared
    networks:
      - web

获取您需要将其作为值放入traefik.frontend.auth.basic发布：

htpasswd -n admin

<强> traefik.toml： defaultEntryPoints = [“http”，“https”]

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.http.redirect]
    entryPoint = "https"

  [entryPoints.https]
  address = ":443"
[entryPoints.https.tls]

[retry]

[api]
dashboard = true


# Enable ACME (Let's Encrypt): automatic SSL.
[acme]
email = "you@mail.com"
storage = "acme.json"
entryPoint = "https"
# If true, display debug log messages from the acme client library.
# acmeLogging = true
# Enable certificate generation on frontends host rules.
onHostRule = true
# CA server to use.
# Uncomment the line to use Let's Encrypt's staging server,
# leave commented to go to prod.
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
# Use a HTTP-01 ACME challenge.
# Optional (but recommended)
[acme.httpChallenge]
  entryPoint = "http"

这使用Let的加密登台环境来获得三个证书。使用caServer注释该行以获得真正的证书！重新创建一个空的acme.json！

seafile-data存储在

/opt/seafile-data/org1

和

/opt/seafile-data/org2

分别

在/ opt / traefik中，您可以启动系统：

docker-compose up -d

并使用

docker-compose logs

启动首次运行需要一些时间来设置seafile，获取证书，......

您的主机应该可以访问，不会出现SSL错误或警告

剩下要做的是编辑每个seafile安装目录（/opt/seafile-data/org1/seafile/conf/ccnet.conf）中的ccnet.conf文件，并将协议更改为“http”并删除来自SERVICE_URL的端口“：8000”，以便共享链接也适用于该设置。该行应为：

SERVICE_URL = https://org1.example.me

Answer 2

您可以在Docker Stacks文件中完成所有操作：

version: "3.7"

services:
  traefik:
    image: traefik:1.7.13
    command: >
      --api
      --docker
      --docker.swarmmode
      --docker.watch
      --docker.exposedbydefault=false
      # --debug=true
      --loglevel=error # debug
      --defaultentrypoints=https,http
      --entryPoints="Name:http Address::80 Redirect.EntryPoint:https"
      --entryPoints="Name:https Address::443 TLS"
      --retry
      --acme=true
      --acme.entrypoint=https
      --acme.httpchallenge
      --acme.httpchallenge.entrypoint=http
      --acme.domains="..."
      --acme.email="..."
      --acme.storage=/certs/acme.json
    ports:
      - 80:80     # HTTP
      - 443:443   # HTTPS
      - 8080:8080 # The Web UI (enabled by --api)
    volumes:
      - acme:/certs
      - /var/run/docker.sock:/var/run/docker.sock:ro

  whoami:
    image: containous/whoami
    deploy:
      labels:
        traefik.frontend.rule: Path:/whoami
        traefik.enable: "true"
        traefik.port: 80

volumes:
  acme:

在两个docker容器前面配置Traefik，全部在端口80上

2 个答案: