Question

我正在为Rails上的APP创建一个完整的管理服务，我的APP在SSL上运行，但是当我运行docker compose时，所有服务都运行正常，例如当我访问portainer等服务时，它就可以工作很好，当我访问我的应用程序时，它重定向到SSL的443端口，然后当我再次尝试访问portainer时，它将重定向到https协议并保留端口，但是服务器不可访问。

这是我的 docker-compose 文件：

version: '3.7'

services:
  redis:
    image: 'redis:latest'
    restart: always
    hostname: redis
    networks:
      - default
    volumes:
      - 'redis:/data'

  db:
    image: mysql
    command: --default-authentication-plugin=mysql_native_password
    restart: always
    hostname: db
    environment:
      MYSQL_ROOT_PASSWORD: 123456
      MYSQL_DATABASE: printi_automation
      MYSQL_USER: root
    networks:
      - default
    ports:
    - "33061:33061"
    volumes:
      - datavolume:/var/lib/mysql

  adminer:
    image: adminer
    restart: always
    networks:
      - default
    ports:
      - 8080:8080

  portainer:
    image: portainer/portainer
    restart: always
    hostname: portainer
    ports:
      - '9000:9000'
    networks:
      - default
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
      - 'portainer_data:/data'

  app:
    image: optimum
    restart: always
    hostname: app
    depends_on:
      - 'redis'
      - 'db'
      - 'hub'
    build:
      context: .
      dockerfile: Dockerfile
    command: bash -c "rm -rf tmp/pids/server.pid && rails server -p 3000 -b '0.0.0.0'"
    volumes:
      - .:/app
      - .:/test
    networks:
      - default
    ports:
        - 3000:3000
    env_file:
      - '.env'

  nginx:
    image: nginx:1.17.1-alpine
    restart: always
    depends_on:
      - 'app'
      - 'portainer'
    networks:
      - default
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./data/nginx:/etc/nginx/conf.d
      - ./data/certbot/conf:/etc/letsencrypt
      - ./data/certbot/www:/var/www/certbot
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'" 

  certbot:
    image: certbot/certbot
    restart: always
    volumes:
      - ./data/certbot/conf:/etc/letsencrypt
      - ./data/certbot/www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

volumes:
  redis:
  datavolume:
  portainer_data:

networks:
  default:
    driver: bridge

还有我的 app.conf ：

# generated 2019-07-10, https://ssl-config.mozilla.org/#server=nginx&server-version=1.17.0&config=intermediate
server {
  listen 80 default_server;
  listen [::]:80 default_server;
  server_name optimum.localhost.com;

  gzip off;

  location / {
    return 301 
    https://$host$request_uri;
  }
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name optimum.localhost.com;

  gzip off;

  location / {
    proxy_pass http://app:3000;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto https;
  }

  # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
  ssl_certificate /etc/letsencrypt/live/optimum.localhost.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/optimum.localhost.com/privkey.pem;
  ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions

  # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam.pem
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

  # HSTS (ngx_http_headers_module is required) (63072000 seconds)
  add_header Strict-Transport-Security "max-age=63072000" always;

  # replace with the IP address of your resolver
  # resolver 127.0.0.1;

  include /etc/letsencrypt/options-ssl-nginx.conf;
}

使用上面的代码，访问我的APP后，本地和在线服务器将重定向到https协议，我可以尝试使用服务上的任何端口，但是它将无法正常工作。

如何防止这种情况发生？

谢谢。

Answer 1

好像您的nginx正在添加HSTS标头

add_header Strict-Transport-Security "max-age=63072000" always;

在此处了解有关HSTS的更多信息：https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

反向代理SSL将端口9000重定向到Rails应用程序和Portainer上的https协议

1 个答案: