FireflyIII的路由选择

Question

你好，堆栈溢出，

我有一个RespberryPi4B，我在上面安装了Ubuntu20。(Linuxubuntu5.4.0-1034-raspi aarch64 -Ubuntu20.04.1lts)

在这个Pi上，我想安装几个仅供本地使用的应用程序。为了能够公开多个应用程序，我使用Traefik作为代理。为了更容易地部署应用程序，我使用Docker和Docker-组合

我已经启动并运行了一个Nextcloud实例，它运行得很好。现在我想添加FireflyIII作为一个应用程序，但路由不符合，并问候我“坏网关”。

这是我拥有的

下面是用于我的Nextcloud的docker-compose.yml，它的工作原理就像一种魅力：

version: '3.3'

services:
  nextcloud-db:
    image: mariadb
    container_name: nextcloud-db
    command: --transaction-isolation=READ-COMMITTED --log-bin=ROW
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /opt/containers/nextcloud/database:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD={supersecret}
      - MYSQL_PASSWORD={supersecret}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloudusr
      - MYSQL_INITDB_SKIP_TZINFO=1
    networks:
      - default

  nextcloud-redis:
    image: redis:alpine
    container_name: nextcloud-redis
    hostname: nextcloud-redis
    networks:
        - default
    restart: unless-stopped
    command: redis-server --requirepass {supersecret}

  nextcloud-app:
    image: nextcloud
    container_name: nextcloud-app
    restart: unless-stopped
    depends_on:
      - nextcloud-db
      - nextcloud-redis
    environment:
        REDIS_HOST: nextcloud-redis
        REDIS_HOST_PASSWORD: {supersecret}
    volumes:
      - /opt/containers/nextcloud/app:/var/www/html
      - /opt/containers/nextcloud/daten:/var/www/html/data

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nextcloud-app.entrypoints=http"
      - "traefik.http.routers.nextcloud-app.rule=Host(`nextcloud.mydomain.com`)"
      - "traefik.http.middlewares.nextcloud-app-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.nextcloud-app.middlewares=nextcloud-app-https-redirect"
      - "traefik.http.routers.nextcloud-app-secure.entrypoints=https"
      - "traefik.http.routers.nextcloud-app-secure.rule=Host(`nextcloud.mydomain.com`)"
      - "traefik.http.routers.nextcloud-app-secure.tls=true"
      - "traefik.http.routers.nextcloud-app-secure.tls.certresolver=http"
      - "traefik.http.routers.nextcloud-app-secure.service=nextcloud-app"
      - "traefik.http.services.nextcloud-app.loadbalancer.server.port=80"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.nextcloud-app-secure.middlewares=nextcloud-dav,secHeaders@file"
      - "traefik.http.middlewares.nextcloud-dav.replacepathregex.regex=^/.well-known/ca(l|rd)dav"
      - "traefik.http.middlewares.nextcloud-dav.replacepathregex.replacement=/remote.php/dav/"
    networks:
      - proxy
      - default

networks:
  proxy:
    external: true

虽然我知道这个配置和这些traefik标签可以工作，但我假设下面的docker-compe.yml(现在用于FireflyIII )也能工作。虽然容器没有任何可见的问题(我可以在容器日志中看到)，但是应用程序连接到数据库并准备好了一切--通过浏览器访问是不可能的--我得到了一个不好的网关。

这是我的FireflyIII的船坞-Compose.yml

version: '3.3'

services:
  fireflydb:
    image: mariadb
    container_name: fireflydb
    environment:
      - MYSQL_RANDOM_ROOT_PASSWORD=yes
      - MYSQL_USER=fireflyuser
      - MYSQL_PASSWORD={supersecret}
      - MYSQL_DATABASE=fireflydb
    volumes:
      - firefly_db:/var/lib/mysql
    networks:
      - default

  firefly:
    image: jc5x/firefly-iii:latest
    container_name: firefly
    volumes:
      - firefly_upload:/var/www/html/storage/upload
    depends_on:
      - fireflydb
    env_file: .env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.firefly-app.entrypoints=http"
      - "traefik.http.routers.firefly-app.rule=Host(`firefly.mydomain.com`)"
      - "traefik.http.middlewares.firefly-app-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.firefly-app.middlewares=firefly-app-https-redirect"
      - "traefik.http.routers.firefly-app-secure.entrypoints=https"
      - "traefik.http.routers.firefly-app-secure.rule=Host(`firefly.mydomain.com`)"
      - "traefik.http.routers.firefly-app-secure.tls=true"
      - "traefik.http.routers.firefly-app-secure.tls.certresolver=http"
      - "traefik.http.routers.firefly-app-secure.service=firefly-app"
      - "traefik.http.services.firefly-app.loadbalancer.server.port=80"
      - "traefik.docker.network=proxy"
    networks:
      - proxy
      - default

volumes:
   firefly_upload:
   firefly_db:

networks:
   proxy:
      external: true

Traefik标签之间的唯一区别是，对于萤火虫，我不需要替换这些标签，并且更改了主机和应用程序名称：

nextcloud.mydomain.com -> firefly.mydomain.com nextcloud-app/nextcloud-app-安全的->萤火虫-app/萤火虫应用程序

我只是还不明白，为什么“相同”配置的行为会有所不同。Traefik容器日志不会抛出任何错误。

关于SSL证书的注意事项，因为应用程序在我的本地网络中运行，并且我编辑本地主机文件以通过浏览器访问应用程序，所以SSL更新是不可能的，我知道这一点。目前，我通过在另一台服务器上手动更新并将证书复制到我的Pi来解决这个问题。又快又脏但现在起作用了。

为了完整起见，这里是我的Traefik的traefik.yml、docker-compose.yml和dynamic_conf.yml：

traefik.yml：

api:
  dashboard: true

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    filename: "/dynamic_conf.yml"

certificatesResolvers:
  http:
    acme:
      email: mymail@mydomain.com
      storage: acme.json
      httpChallenge:
        entryPoint: http

docker-compose.yml：

version: '3'

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/traefik.yml:/traefik.yml:ro
      - ./data/acme.json:/acme.json
      - ./data/dynamic_conf.yml:/dynamic_conf.yml
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`traefik.mydomain.com`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=user:secret"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.mydomain.com`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=http"
      - "traefik.http.routers.traefik-secure.service=api@internal"
      - "providers.file.filename=/dynamic_conf.yml"

networks:
  proxy:
    external: true

dynamic_conf.yml

tls:
  options:
    default:
      minVersion: VersionTLS12

      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
        - TLS_AES_128_GCM_SHA256
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256

      curvePreferences:
        - CurveP521
        - CurveP384

      sniStrict: true

http:
  middlewares:
    secHeaders:
      headers:
        browserXssFilter: true
        contentTypeNosniff: true
        frameDeny: true
        sslRedirect: true
        #HSTS Configuration
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
        customFrameOptionsValue: "SAMEORIGIN"

我唯一能想到的可能是内部港口的问题。但我对traefik和码头还不太了解，可以肯定地说。

我感谢任何改进的提示和建议。

Answer 1

乍一看，我建议将port改为8080

version: '3.3'

services:
# [...]
  firefly:
    labels:
# 
      - "traefik.http.services.firefly-app.loadbalancer.server.port=8080"
# [...]

您使用的firefly-iii-Image是基于他们的BaseImage，即README.md说：

--基本上，我使用了7.4Apache映像，并做了一些小改动。

其中一个变化是：

切换到端口8080