我正在尝试为tine20 Docker容器（使用apache2作为Web服务器）将nginx配置为反向代理（使用通过network_mode: host运行的nginx docker容器）。
我正在使用以下反向代理配置：
server {
listen 443 ssl http2;
server_name ${DOMAIN};
ssl_certificate /etc/letsencrypt/live/${PATH}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${PATH}/privkey.pem;
ssl_dhparam /etc/ssl/dhparams.pem;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" always;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
root /etc/letsencrypt/webrootauth;
location / {
proxy_pass http://${UPSTREAM};
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache anonymous;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
}
location /.well-known/acme-challenge {
alias /etc/letsencrypt/webrootauth/.well-known/acme-challenge;
location ~ /.well-known/acme-challenge/(.*) {
add_header Content-Type application/jose+json;
}
}
}
server {
listen 80;
server_name ${DOMAIN};
return 301 https://$server_name$request_uri;
}
tine20容器中的Apache使用以下配置：
# Apache and PHP configuration for Tine 2.0
#
# Alias /tine20 /usr/share/tine20
# Alias /Microsoft-Server-ActiveSync /usr/share/tine20/Microsoft-Server-ActiveSync
# some people prefer a simple URL like http://tine20.example.org
# in this case you also have to disable to Alias lines above
<VirtualHost *:80>
DocumentRoot /usr/share/tine20
ServerName ${SERVER_NAME}
</VirtualHost>
<Directory /usr/share/tine20>
Order Allow,Deny
Allow from all
DirectoryIndex index.php
Options +ExecCGI
<IfModule mod_php5.c>
Define PHP_MODULE_INSTALLED
</IfModule>
<IfModule mod_php7.c>
Define PHP_MODULE_INSTALLED
</IfModule>
<IfDefine PHP_MODULE_INSTALLED>
php_admin_value max_input_time 120
php_admin_value include_path .:/usr/share/tine20:/usr/share/tine20/library:/usr/share/tine20/vendor/zendframework/zendframework1/library:/etc/tine20
php_admin_value open_basedir /usr/share/tine20:/var/lib/tine20:/tmp:/usr/share/php:/etc/tine20:/var/log/tine20
php_admin_value session.gc_maxlifetime 86400
php_admin_value memory_limit 128M
php_admin_value upload_max_filesize 20M
php_admin_value post_max_size 20M
php_admin_value safe_mode off
php_admin_flag display_errors off
php_admin_flag log_errors on
php_admin_flag magic_quotes_gpc off
php_admin_flag magic_quotes_runtime off
php_admin_flag register_globals off
<IfModule mod_headers.c>
# activate zlib compression and remove content-length header
# this is necessary because of this php bug: https://bugs.php.net/bug.php?id=44164
php_admin_flag zlib.output_compression on
<FilesMatch "\.php$">
Header unset Content-Length
</FilesMatch>
</IfModule>
php_value max_execution_time 90
</IfDefine>
<IfModule mod_rewrite.c>
RewriteEngine on
# needs to be adopted if tine20 is not in subdir /tine20
RewriteBase /tine20
# ActiveSync
RewriteRule ^Microsoft-Server-ActiveSync index.php?frontend=activesync [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
# OpenID
RewriteRule ^users/(.*) index.php?frontend=openid&username=$1 [L,QSA]
# WebDAV / CalDAV / CardDAV
RewriteCond %{REQUEST_METHOD} !^(GET|POST)$
RewriteRule ^$ index.php?frontend=webdav [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
RewriteRule ^addressbooks index.php?frontend=webdav [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
RewriteRule ^calendars index.php?frontend=webdav [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
RewriteRule ^webdav index.php?frontend=webdav [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
RewriteRule ^principals index.php?frontend=webdav [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
RewriteRule ^remote.php index.php?frontend=webdav [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
# Anonymous downloads
RewriteRule ^download/get/(.*) index.php?method=Download.downloadNode&path=$1 [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
RewriteRule ^download/show/(.*) index.php?method=Download.displayNode&path=$1 [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
# Routing
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php?doRouting=1 [E=REMOTE_USER:%{HTTP:Authorization},L,QSA]
</IfModule>
<IfModule mod_expires.c>
ExpiresActive on
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
</IfModule>
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/json
<IfModule mod_headers.c>
# properly handle requests coming from behind proxies
Header append Vary User-Agent env=!dont-vary
</IfModule>
</IfModule>
</Directory>
使用此配置，我遇到了Firefox开发者控制台日志中显示的以下错误：
Mixed Content: The page at 'https://localhost/' was loaded over HTTPS, but requested an insecure script 'http://localhost/Tinebase/js/fatClient.js-c79fcf9f7cddb7b5e69e-FAT.js'. This request has been blocked; the content must be served over HTTPS.
(index):1 Mixed Content: The page at 'https://localhost/' was loaded over HTTPS, but requested an insecure script 'http://localhost/index.php?method=Tinebase.getJsTranslations&locale=en&app=all&version=ce92dfccacd6bf202116c419e856ffea17b37604'. This request has been blocked; the content must be served over HTTPS.
要重现此错误并可以尝试进行配置，请遵循此repository中的说明。
此错误的问题是，从docker容器托管的tine20应用程序在访问登录页面（https://localhost/）时永久卡住加载，因为脚本文件被浏览器阻止。
如果您从开发者控制台复制了所请求的http网址，然后将m粘贴到网址栏中，则脚本将被加载，并且还会正确重定向到https地址（通过301）。
现在我还不太明白为什么会出现错误，以及如何正确加载内容。
答案 0 :(得分：0)
混合内容：“ https://localhost/”页面已通过HTTPS加载，但请求了不安全脚本“ http://localhost/Tinebase/js/fatClient.js-c79fcf9f7cddb7b5e69e-FAT.js”。该请求已被阻止；内容必须通过HTTPS提供。
您的问题的解决方案是上述错误消息This request has been blocked; the content must be served over HTTPS.的最后一位
因此，当页面通过http加载时，您正在https上提供某些资产，而浏览器很长时间以来都不允许这样做。
页面卡住的原因是服务器*FAT.js阻塞的资产对于呈现页面必不可少。
修复源代码，以使用相对模式（也就是没有http(s)位，以//example.com/path/to/something开头）在通过页面服务的模式上加载源代码。
根据您的具体情况更改为：
//localhost/Tinebase/js/fatClient.js-c79fcf9f7cddb7b5e69e-FAT.js
通过这种方式，它将使用正在加载页面的相同http模式来加载资源。
对于引发此消息的每个资源重复此操作：
此请求已被阻止；内容必须通过HTTPS提供。