Nginx 代理背后的 SSL SpringBoot App Docker 容器

Posted 2023-02-27

【中文标题】Nginx 代理背后的 SSL SpringBoot App Docker 容器

【英文标题】：SSL SpringBoot App Docker container behind Nginx Proxy

【发布时间】：2018-03-09 15:41:47

【问题描述】：

我有一个 Docker 容器，带有 Spring Boot 微服务。

我还有一个 Docker 容器，配置了 SSL 的 jwilder/nginx-proxy 工作正常。这个想法是用 SSL 做一个代理。

但是当我尝试调用 spring boot 微服务时，我得到下一个错误：

SpringBoot App也需要做SSL配置吗？

像这样？：

server.port: 443
server.ssl.key-store: keystore.p12
server.ssl.key-store-password: mypassword
server.ssl.keyStoreType: PKCS12
server.ssl.keyAlias: tomcat

Default.conf Nginx 文件（由 Nginx Docker 镜像自动生成）。

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto 
  default $http_x_forwarded_proto;
  ''      $scheme;

# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port 
  default $http_x_forwarded_port;
  ''      $server_port;

# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection 
  default upgrade;
  '' close;

# Apply fix for very long server names
server_names_hash_bucket_size 128;
# Default dhparam
ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl 
  default off;
  https on;

gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';
access_log off;
resolver 10.12.149.2;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
server 
        server_name _; # This is just an invalid value which will never trigger on a real hostname.
        listen 80;
        access_log /var/log/nginx/access.log vhost;
        return 503;

server 
        server_name _; # This is just an invalid value which will never trigger on a real hostname.
        listen 443 ssl http2;
        access_log /var/log/nginx/access.log vhost;
        return 503;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/default.crt;
        ssl_certificate_key /etc/nginx/certs/default.key;

# app.example.com
upstream app.example.com 
                                ## Can be connect with "bridge" network
                        # crdx_app-test
                        server 172.18.0.2:80;

server 
        server_name app.example.com;
        listen 80 ;
        access_log /var/log/nginx/access.log vhost;
        return 301 https://$host$request_uri;

server 
        server_name app.example.com;
        listen 443 ssl http2 ;
        access_log /var/log/nginx/access.log vhost;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS';
        ssl_prefer_server_ciphers on;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/app.example.com.crt;
        ssl_certificate_key /etc/nginx/certs/app.example.com.key;
        add_header Strict-Transport-Security "max-age=31536000";
        location / 
                proxy_pass https://app.example.com;
        

【参考方案1】：

SpringBoot App也需要做SSL配置吗？

没有。只要您确定 nginx 到 Spring Boot 网络不会被任何其他方监听或篡改，您就不必在您的 Spring Boot 应用上启用 SSL。

那为什么 nginx 会给出 503。

在看到您的 nginx 配置之前，我不知道答案。很可能，您的 nginx 配置存在一些问题。这个article 可以帮助您设置带有 SSL 终止的 nginx 反向代理。

【讨论】：

感谢您的回复，我已经添加了default.conf nginx配置文件。当应用容器启动时，由 jwilder/nginx-proxy 码头图像自动生成。

【参考方案2】：

我找到了解决方案，而且非常简单。 两个容器，Nginx 和应用程序的容器，必须在同一个网络下，这不应该是默认的。

例如：

Nginx 容器

docker run -d -p 80:80 -p 443:443 --network="mynetwork" -v /path/to/certs:/etc/nginx/certs -v /var/run/docker.sock:/tmp/docker.sock:ro jwilder/nginx-proxy:alpine

应用容器

docker run -p 8080 --network="mynetwork" -e VIRTUAL_HOST=app.example.com --name ssl_test -d sslapptest

这种方式 SSL 完美运行