Caddy允许HTTP与Api平台

Question

我知道这个问题已经问过很多次了：

1. 如何仅对一个域禁用https
2. 禁用caddy ssl以启用通过Gitlab CI运行的部署到云
3. 局部域上的稻田设置HTTPS
4. 从Docker运行时如何禁用TLS？
5. 如何同时为http和https提供服务？

但这是我的问题。

设置

我按照他们的文档创建了一个新的Api平台项目。

最简单和最强大的入门方法是下载API平台分布

我下载了发行版2.5.6，在其中我们可以找到：

• 一个码头工
• 一个Dockerfile
• 一个卡迪文件
• 还有很多其他文件。

码头工

通过移除pwa服务和PostgreSQL，我稍微改变了对接器撰写文件：

version: "3.4"

services:
  php:
    build:
      context: ./api
      target: api_platform_php
    restart: unless-stopped
    env_file:
      - api/.env
    volumes:
      - php_socket:/var/run/php
    healthcheck:
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 30s

  caddy:
    build:
      context: api/
      target: api_platform_caddy
    env_file:
      - api/.env
    depends_on:
      - php
    environment:
      MERCURE_PUBLISHER_JWT_KEY: ${MERCURE_PUBLISHER_JWT_KEY:-!ChangeMe!}
      MERCURE_SUBSCRIBER_JWT_KEY: ${MERCURE_SUBSCRIBER_JWT_KEY:-!ChangeMe!}
    restart: unless-stopped
    volumes:
      - php_socket:/var/run/php
      - caddy_data:/data
      - caddy_config:/config
    ports:
      # HTTP
      - target: 80
        published: 80
        protocol: tcp
      # HTTPS
      - target: 443
        published: 443
        protocol: tcp
      # HTTP/3
      - target: 443
        published: 443
        protocol: udp

volumes:
  php_socket:
  caddy_data:
  caddy_config:

Dockerfile

无变化

卡迪文件

通过注释行reverse_proxy @pwa http://{$PWA_UPSTREAM}进行轻微更改

{
    # Debug
    {$DEBUG}
    # HTTP/3 support
    servers {
        protocol {
            experimental_http3
        }
    }
}

{$SERVER_NAME}

log

# Matches requests for HTML documents, for static files and for Next.js files,
# except for known API paths and paths with extensions handled by API Platform
@pwa expression `(
        {header.Accept}.matches("\\btext/html\\b")
        && !{path}.matches("(?i)(?:^/docs|^/graphql|^/bundles/|^/_profiler|^/_wdt|\\.(?:json|html$|csv$|ya?ml$|xml$))")
    )
    || {path} == "/favicon.ico"
    || {path} == "/manifest.json"
    || {path} == "/robots.txt"
    || {path}.startsWith("/_next")
    || {path}.startsWith("/sitemap")`

route {
    root * /srv/api/public
    mercure {
        # Transport to use (default to Bolt)
        transport_url {$MERCURE_TRANSPORT_URL:bolt:///data/mercure.db}
        # Publisher JWT key
        publisher_jwt {env.MERCURE_PUBLISHER_JWT_KEY} {env.MERCURE_PUBLISHER_JWT_ALG}
        # Subscriber JWT key
        subscriber_jwt {env.MERCURE_SUBSCRIBER_JWT_KEY} {env.MERCURE_SUBSCRIBER_JWT_ALG}
        # Allow anonymous subscribers (double-check that it's what you want)
        anonymous
        # Enable the subscription API (double-check that it's what you want)
        subscriptions
        # Extra directives
        {$MERCURE_EXTRA_DIRECTIVES}
    }
    vulcain
    push

    # Add links to the API docs and to the Mercure Hub if not set explicitly (e.g. the PWA)
    header ?Link `</docs.jsonld>; rel="http://www.w3.org/ns/hydra/core#apiDocumentation", </.well-known/mercure>; rel="mercure"`
    # Disable Google FLOC tracking if not enabled explicitly: https://plausible.io/blog/google-floc
    header ?Permissions-Policy "interest-cohort=()"

    # Comment the following line if you don't want Next.js to catch requests for HTML documents.
    # In this case, they will be handled by the PHP app.
    # reverse_proxy @pwa http://{$PWA_UPSTREAM}

    php_fastcgi unix//var/run/php/php-fpm.sock
    encode zstd gzip
    file_server
}

结果

我可以在https://localhost上访问我的网站，但是没有https我就无法访问它，因为https 自动重定向 http流量到https

问题1

当我尝试解决方案auto_https时，它不起作用。

在这里，我尝试过：

• 添加auto_https off

{
    auto_https off
    # Debug
    {$DEBUG}
    # HTTP/3 support
    servers {
        protocol {
            experimental_http3
        }
    }
    //...
}

当我尝试访问http://localhost:80时，我被重定向到https://localhost，我得到了This site can’t provide a secure connection

问题2

当我尝试解决方案时

没有在配置中提供任何主机名或IP地址

我将{$SERVER_NAME}从我的Caddyfile文件中删除

当我尝试访问http://localhost:80时，我被重定向到https://localhost，我得到了This site can’t provide a secure connection

问题3

当我尝试解决方案时

独占侦听HTTP端口

services:
  # ...
  caddy:
    build:
      context: api/
      target: api_platform_caddy
    #...
    ports:
      # HTTP
      - target: 80
        published: 80
        protocol: tcp
      # HTTPS
      #- target: 443
      #  published: 443
      #  protocol: tcp
      # HTTP/3
      #- target: 443
      #  published: 443
      #  protocol: udp

当我尝试访问http://localhost:80时，我被重定向到https://localhost，我得到了This site can’t be reached

问题

我如何允许在我的caddy服务器上使用http (并且仍然在我的Caddyfile中保留我的配置？)

Answer 1

我在这里找到了解决办法：

https://github.com/caddyserver/caddy/issues/3219#issuecomment-608236439

卡迪文件

{
    http_port 8080
    # Debug
    {$DEBUG}
    # HTTP/3 support
    servers {
        protocol {
            experimental_http3
        }
    }
    //...
}

码头工

services:
  caddy:
    # ...
    ports:
      # HTTP
      - target: 80
        published: 80
        protocol: tcp
      - target: 8080
        published: 8080
        protocol: tcp
      # HTTPS
      - target: 443
        published: 443
        protocol: tcp
      # HTTP/3
      - target: 443
        published: 443
        protocol: udp