Question

我已经在单独的docker容器上发布了我的API，ID服务器STS和Web ui，并且我正在使用nginx容器作为反向代理来为这些应用程序提供服务。我可以浏览到每个，甚至可以打开STS的发现端点。问题出在我尝试登录Web门户时，它尝试将我重定向回STS以进行登录，但是我得到 ERR_CONNECTION_REFUSED 的网址看起来还可以，我认为这是不可用的STS从Web UI重定向。

我的docker-compose如下：

version: '3.4'

services:
  reverseproxy:
    container_name: reverseproxy
    image: nginx:alpine
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - ./proxy.conf:/etc/nginx/proxy.conf
      - ./cert:/etc/nginx
    ports:
      - 8080:8080
      - 8081:8081
      - 8082:8082
      - 443:443
    restart: always
    links:
      - sts
      sts:
    container_name: sts
    image: idsvrsts:latest
    links:
      - localdb
    expose:
      - "8080"

  kernel:
    container_name: kernel
    image: kernel_api:latest
    depends_on:
      - localdb
    links:
      - localdb

  portal:
    container_name: portal
    image: webportal:latest
    environment:
      - TZ=Europe/Moscow
    depends_on:
      - localdb
      - sts
      - kernel
      - reverseproxy

  localdb:
    image: mcr.microsoft.com/mssql/server
    container_name: localdb
    environment:
      - 'MSSQL_SA_PASSWORD=password'
      - 'ACCEPT_EULA=Y'
      - TZ=Europe/Moscow
    ports:
      - "1433:1433"
    volumes:
      - "sqldatabasevolume:/var/opt/mssql/data/"

volumes:
  sqldata:

这是nginx.config：

worker_processes 1;

events { worker_connections 1024; }

http {

    sendfile on;
    upstream docker-sts {
        server sts:8080;
    }
    upstream docker-kernel {
        server kernel:8081;
    }
    upstream docker-portal {
        server portal:8081;
    }
    ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_certificate cert.pem;
    ssl_certificate_key key.pem;
    ssl_password_file global.pass;
    proxy_http_version 1.1;
    proxy_set_header   Upgrade $http_upgrade;
    proxy_set_header   Connection keep-alive;
    proxy_cache_bypass $http_upgrade;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Host $server_name;
    proxy_set_header X-Forwarded-Proto $scheme;

    server {
        listen 8080;
        listen [::]:8080;
        server_name sts;

        location / {
            proxy_pass         http://docker-sts;
            # proxy_redirect     off;
        }
    }

    server {
        listen 8081;
        listen [::]:8081;
        server_name kernel;

        location / {
            proxy_pass         http://docker-kernel;
        }
    }

    server {
        listen 8082;
        listen [::]:8082;
        server_name portal;

        location / {
            proxy_pass         http://docker-portal;
        }
    }
}

Web ui重定向到以下URL，如果我使用不带nginx的STS服务器浏览到该URL，则可以正常工作。

http://localhost/connect/authorize?client_id=myclient.id&redirect_uri=http%3A%2F%2Flocalhost%3A22983%2Fstatic%2Fcallback.html&response_type=id_token%20token&scope=openid%20profile%20kernel.api&state=f919149753884cb1b8f2b907265dfb8f&nonce=77806d692a874244bdbb12db5be40735

Answer 1

发现了问题。容器彼此看不到，因为nginx没有在端口上附加端口。我改变了这个： 'proxy_set_header主机$ host;' 对此： 'proxy_set_header主机$ host：$ server_port;'

如何配置IdentityServer4（DotNet Core）在Nginx反向代理中工作

1 个答案: