Docker配置docker-compose和nginx，让jenkins在nginx后面

Question

我是docker和nginx的新手，我设法让nginx和HTTPS在容器中运行，我想在nginx后面添加jenkins。我不想在我的服务器上打开新的端口，我希望所有的流量都通过我的nginx。

我如何编写我的docker-compose.yaml和app.conf (nginx的配置文件)来让它们一起工作？这是我的配置文件，我已经用一个虚拟的example.com替换了我的域名，我希望jenkins可以在jenkins.example.com上使用。

docker-compose.yml

nginx:
  image: nginx:1.17-alpine
  container_name: nginx-docker
  ports:
    - "80:80"
    - "443:443"
  volumes:
    - ./data/nginx:/etc/nginx/conf.d
    - ./data/html:/etc/nginx/html
jenkins:
  image: "jenkins/jenkins:lts"
  container_name: jenkins-docker
  volumes:
    - ./data/jenkins:/var/jenkins_home
  expose:
    - "8080"
  ports:
    - "50000:50000"

app.conf

server {
    listen 80;
    server_name example.com;

    location / {
        return 301 https://$host$request_uri;
    } 
}

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        root html;
        index index.html;
    }
}

Answer 1

要将nginx的工作配置用作Jenkins的反向代理，您应该查看Official Jenkins Wiki。在那里你可以找到许多不同用例的示例(使用/不使用SSL、AWS、…)

考虑到nginx也运行在Docker容器中(在同一网络中)，这里必须更改的是，您不能重定向到localhost:8080，而是jenkins:8080 ( Docker服务的名称，同一网络中的容器可以使用它进行通信)。

除此之外，您的docker-compose.yml看起来还不错。这里唯一要做的就是将端口50000映射到主机的端口50000。如果您不想在机器上打开任何新端口，并且希望所有流量都通过nginx，那么我真的看不出这样做有什么意义。公开它(就像您对端口8080所做的那样)就足够了，然后您可以添加一行到nginx，以将特定子域的请求定向到那里，例如。

Answer 2

以下是我的配置文件的最终版本：

docker-compose

  nginx:
    image: nginx:1.17-alpine
    container_name: nginx-docker
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./data/nginx:/etc/nginx/conf.d
      - ./data/html:/etc/nginx/html
  jenkins:
    image: "jenkins/jenkins:lts"
    container_name: jenkins-docker
    volumes:
      - ./data/jenkins:/var/jenkins_home
    expose:
      - "8080"

app.conf

server {
    listen 80;
    server_name example.com *.example.com;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        root html;
        index index.html;
    }
}

upstream jenkins {
  server jenkins:8080 fail_timeout=0;
}

server {
  listen 443 ssl;
  server_name jenkins.example.com;

  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

  location / {
    proxy_set_header        Host $host:$server_port;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_redirect http:// https://;
    proxy_pass              http://jenkins;
    # Required for new HTTP-based CLI
    proxy_http_version 1.1;
    proxy_request_buffering off;
    proxy_buffering off; # Required for HTTP-based CLI to work over SSL
    # workaround for https://issues.jenkins-ci.org/browse/JENKINS-45651
    add_header 'X-SSH-Endpoint' 'jenkins.domain.tld:50022' always;
  }
}