Api-nginx代理背后的平台坞部署

Question

我正在尝试部署一个api平台的快速演示。在此之前，如果我在讨论或文档中遗漏了一些东西，我很抱歉，我不习惯在部署上工作，也可能没有看到正确的位置。

我使用的服务器已经运行了一些码头容器，因此我使用nginx/nginx代理停靠容器作为反向代理。我查看了api-platofrm文档中关于如何使用docker：https://api-platform.com/docs/deployment/docker-compose/#deploying进行部署的文档，但是由于我正在研究这个主题，所以我在"502坏网关“或”页面没有正确地重定向“错误之间发展。

实际上我有个码头工人。

version: "3.4"

services:
  php:
    build:
      context: ./api
      target: api_platform_php
    depends_on:
      - database
    restart: unless-stopped
    volumes:
      - php_socket:/var/run/php
    healthcheck:
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 30s
    networks:
      - 'cloud'

  caddy:
    build:
      context: api/
      target: api_platform_caddy
    depends_on:
      - php
    environment:
      PWA_UPSTREAM: pwa:3000
      SERVER_NAME: ${SERVER_NAME:-localhost, caddy:80}
      MERCURE_PUBLISHER_JWT_KEY: ${MERCURE_PUBLISHER_JWT_KEY:-!ChangeMe!}
      MERCURE_SUBSCRIBER_JWT_KEY: ${MERCURE_SUBSCRIBER_JWT_KEY:-!ChangeMe!}
    restart: unless-stopped
    volumes:
      - php_socket:/var/run/php
      - caddy_data:/data
      - caddy_config:/config
    ports:
      # HTTP
      - target: 80
        published: 7000
        protocol: tcp
      # HTTPS
      - target: 443
        published: 7001
        protocol: tcp
      # HTTP/3
      - target: 443
        published: 7001
        protocol: udp
    networks:
      - 'cloud'

  database:
    image: postgres:13-alpine
    environment:
      - POSTGRES_DB=api
      - POSTGRES_PASSWORD=!ChangeMe!
      - POSTGRES_USER=api-platform
    volumes:
      - db_data:/var/lib/postgresql/data:rw
      # you may use a bind-mounted host directory instead, so that it is harder to accidentally remove the volume and lose all your data!
      # - ./api/docker/db/data:/var/lib/postgresql/data:rw
    networks:
      - 'cloud'

volumes:
  php_socket:
  db_data:
  caddy_data:
  caddy_config:


networks:
  cloud:
    external: true

以及这个对接者-复合文件：

version: "3.4"

# Preproduction environment override
services:
  php:
    environment:
      APP_ENV: prod
      APP_SECRET: ${APP_SECRET}

  caddy:
    environment:
      MERCURE_PUBLISHER_JWT_KEY: ${MERCURE_PUBLISHER_JWT_KEY:-!ChangeMe!}
      MERCURE_SUBSCRIBER_JWT_KEY: ${MERCURE_SUBSCRIBER_JWT_KEY:-!ChangeMe!}
      VIRTUAL_HOST: api-preprod.melofeel.com
      VIRTUAL_PORT: 80
      LETSENCRYPT_HOST: api-preprod.melofeel.com

我正在使用gitlab部署它，并使用以下命令启动它：SERVER_NAME=******.*****.com APP_SECRET=testdeploy POSTGRES_PASSWORD=testdeploy CADDY_MERCURE_JWT_SECRET=testdeploy docker-compose -f api_preprod/docker-compose.yml -f api_preprod/docker-compose.preprod.yml up -d

我试着用和不带卡迪一起运行它，没有我总是得到"502坏网关“。

这3个容器正在运行，但是当我查看Caddy日志时，我得到了以下消息：

{"level":"error","ts":1648201680.3190682,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"*****.*****.com","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Invalid response from http://*****.*****.com/.well-known/acme-challenge/O9zJRdytI8vlf7yZLRcV9pzUlmI73ysCqQJTHg8XWTw [188.165.218.39]: 404","instance":"","subproblems":[]}}

我试图从caddy中禁用自动https，nginx代理已经对此负责，但它似乎不起作用。我的卡迪档案：

{
    # Debug
    {$DEBUG}
    # HTTP/3 support
    servers {
        protocol {
            experimental_http3
        },
        auto_https disable_redirects
    }
}

{$SERVER_NAME}

log

# Matches requests for HTML documents, for static files and for Next.js files,
# except for known API paths and paths with extensions handled by API Platform
@pwa expression `(
        {header.Accept}.matches("\\btext/html\\b")
        && !{path}.matches("(?i)(?:^/docs|^/graphql|^/bundles/|^/_profiler|^/_wdt|\\.(?:json|html$|csv$|ya?ml$|xml$))")
    )
    || {path} == "/favicon.ico"
    || {path} == "/manifest.json"
    || {path} == "/robots.txt"
    || {path}.startsWith("/_next")
    || {path}.startsWith("/sitemap")`

route {
    root * /srv/api/public
    mercure {
        # Transport to use (default to Bolt)
        transport_url {$MERCURE_TRANSPORT_URL:bolt:///data/mercure.db}
        # Publisher JWT key
        publisher_jwt {env.MERCURE_PUBLISHER_JWT_KEY} {env.MERCURE_PUBLISHER_JWT_ALG}
        # Subscriber JWT key
        subscriber_jwt {env.MERCURE_SUBSCRIBER_JWT_KEY} {env.MERCURE_SUBSCRIBER_JWT_ALG}
        # Allow anonymous subscribers (double-check that it's what you want)
        anonymous
        # Enable the subscription API (double-check that it's what you want)
        subscriptions
        # Extra directives
        {$MERCURE_EXTRA_DIRECTIVES}
    }
    vulcain
    push

    # Add links to the API docs and to the Mercure Hub if not set explicitly (e.g. the PWA)
    header ?Link `</docs.jsonld>; rel="http://www.w3.org/ns/hydra/core#apiDocumentation", </.well-known/mercure>; rel="mercure"`

    # Comment the following line if you don't want Next.js to catch requests for HTML documents.
    # In this case, they will be handled by the PHP app.
    reverse_proxy @pwa http://{$PWA_UPSTREAM}

    php_fastcgi unix//var/run/php/php-fpm.sock
    encode zstd gzip
    file_server
}

谢谢您的帮助和解释，让我了解问题的所在。

Answer 1

我通过将caddy服务器名更改为

  SERVER_NAME: ${SERVER_NAME:-localhost, caddy}:80

然后，在Nginx代理中，使用HTTPS证书等将其重定向到IP over http到端口80，但我发现这会中断Vulcain的预加载获取请求，并出现以下错误

A preload for '<URL>' is found, but is not used because the request credentials mode does not match. Consider taking a look at crossorigin attribute.

我还没有设法修复它，当我将DNS记录直接指向运行对接程序的服务器(而不是Nginx-Proxy )时，可以确认我的设置工作正常。