nginx + docker 反向代理中的保险库
[英]nginx + vault in docker reverse proxy
问题描述
I'd need to configure nginx as reverse proxy for some apps run in docker.
对于在 docker 中运行的某些应用程序，我需要将 nginx 配置为反向代理。 Portainer is working well, but HashiCorp Vault has still issues. Portainer 运行良好，但 HashiCorp Vault 仍然存在问题。 Further steps will be using nginx for SSL connection for all running apps.进一步的步骤将是使用 nginx 连接所有正在运行的应用程序的 SSL。 All the apps are in most simply setting I could use without any special features.所有应用程序都处于最简单的设置中，我可以在没有任何特殊功能的情况下使用。
Environment环境
- Centos 7 Centos 7
- nginx from rpm 1.16.1-1 (for debug option, in further use it should be in container as well) nginx 来自 rpm 1.16.1-1（对于调试选项，在进一步使用时它也应该在容器中）
- portainer搬运工
- vault 1.2.4保险库 1.2.4
/etc/nginx/nginx.conf
{
"backend": {
"file": {
"path": "/vault/file"
}
},
"listener": {
"tcp":{
"address": "0.0.0.0:8200",
"tls_disable": 1
}
},
"ui": true,
"disable_mlock": true,
"disable_clustering": true
}
/var/lib/docker/volumes/vault_vault_config/_data/vault.json /var/lib/docker/volumes/vault_vault_config/_data/vault.json
{ "backend": { "file": { "path": "/vault/file" } }, "listener": { "tcp":{ "address": "0.0.0.0:8200", "tls_disable": 1 } }, "ui": true, "disable_mlock": true, "disable_clustering": true } {“后端”：{“文件”：{“路径”：“/vault/file”}}，“监听器”：{“tcp”：{“地址”：“0.0.0.0:8200”，“tls_disable”： 1 } }，“ui”：真，“disable_mlock”：真，“disable_clustering”：真}
Note: "disable_mlock" is needed to run in docker, "disable_clustering" should solve my issue, but it's not working as expected.注意：在 docker 中运行需要“disable_mlock”，“disable_clustering”应该可以解决我的问题，但它没有按预期工作。
/var/lib/docker/apps/vault-stack.yml /var/lib/docker/apps/vault-stack.yml
version: '3.2' services: vault: image: vault deploy: replicas: 1 ports: - 8200:8200 environment: - VAULT_ADDR=http://127.0.0.1:8200 volumes: - vault_config:/vault/config - vault_logs:/vault/logs - vault_file:/vault/file entrypoint: vault server -config=/vault/config/vault.json volumes: vault_config: driver: local vault_file: driver: local vault_logs: driver: local
Issue问题
Portainer is working well, but with vault I have still issue that I get 404 error. Portainer 运行良好，但使用 Vault 我仍然遇到 404 错误的问题。 When I go to http://1.2.3.4/vault I get redirection to http://1.2.3.4/ui which obviously doesn't exist.当我从 go 到http://1.2.3.4/vault我得到重定向到http://1.2.3.4/ui这显然不存在As I found out, it's because of "307 Temporary Redirect" Here comes some output from /var/log/nginx/error.log正如我发现的那样，这是因为“307 Temporary Redirect” 来自 /var/log/nginx/error.log 的一些 output
2019/11/12 14:06:41 [debug] 13564#13564: *8 using configuration "/vault/" 2019/11/12 14:06:41 [debug] 13564#13564: *8 HTTP/1.1 301 Moved Permanently Location: http://1.2.3.4/vault/ 2019/11/12 14:06:41 [notice] 13564#13564: *8 "^/vault(/.*)" matches "/vault/", client: 10.20.30.40, server: 1.2.3.4, request: "GET /vault/ HTTP/1.1", host: "1.2.3.4" 2019/11/12 14:06:41 [notice] 13564#13564: *8 rewritten data: "/", args: "", client: 10.20.30.40, server: 1.2.3.4, request: "GET /vault/ HTTP/1.1", host: "1.2.3.4" 2019/11/12 14:06:41 [debug] 13564#13564: *8 HTTP/1.1 307 Temporary Redirect Location: /ui/ 2019/11/12 14:06:41 [error] 13564#13564: *8 "/etc/nginx/html/ui/index.html" is not found (2: No such file or directory), client: 10.20.30.40, server: 1.2.3.4, request: "GET /ui/ HTTP/1.1", host: "1.2.3.4"
What I've tried我试过的
Almost everything:) Spent already too many hours to make this working and that's the reason why I'm here.几乎所有东西:) 已经花了太多时间来完成这项工作，这就是我在这里的原因。 I've got many different errors from 500 Internal to "too many redirects" when I tried to catch the redirection and put there my own.当我试图捕捉重定向并将我自己的重定向放在那里时，我遇到了许多不同的错误，从 500 Internal 到“重定向太多”。 Tried to solve it on "server" side in vault by disabling clustering (as in vault.json)试图通过禁用集群在保险库的“服务器”端解决它（如在 vault.json 中）
1 个解决方案
解决方案1
2 2020-06-18 13:21:37
I tried to achieve the same thing.我试图达到同样的目的。 This is the only way I got it working...这是我让它工作的唯一方法......
location /vault/ {
proxy_pass http://vault:8200/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Accept-Encoding ""; # needed for sub_filter to work with gzip enabled (https://stackoverflow.com/a/36274259/3375325)
proxy_redirect /ui/ /vault/ui/;
sub_filter '<head>' '<head><base href="/vault/">';
sub_filter '"/ui/' '"ui/';
sub_filter_once off;
}
location /v1 {
proxy_pass http://vault:8200;
}
Solution mostly taken from https://github.com/Folcky/hashicorp-vault-and-nginx/blob/master/vault.location解决方案主要取自https://github.com/Folcky/hashicorp-vault-and-nginx/blob/master/vault.location
A cleaner solution IMHO would be to use a sub-domain like vault.mycompany.com to be able to exclusively use the root context.恕我直言，更清洁的解决方案是使用vault.mycompany.com之类的子域，以便能够独占使用根上下文。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.