堆栈内存溢出
  繁体   English   中英

AWS EC2：无法使用letsencrypt和nginx通过docker到达端口80或443（https）

[英]AWS EC2: Cannot reach port 80 or 443 (https) using letsencrypt and nginx via docker

 原文  2020-06-04 12:24:34  1   1    amazon-web-services/ docker/ nginx/ lets-encrypt

问题描述

我想使用 docker-compose 文件设置 nginx 服务器，使用letsencrypt在我的AWS EC 2实例上启用https。

但是端口 80 和端口 443 似乎已关闭。

应用程序本身在可以访问的端口 5000 下运行，但是没有启用https 。

编辑这里是（几乎）完整的 docker-compose.yml，我只在“服务”下添加了最后一部分，称为letsencrypt 。 遗漏标记为（ [...] ）：

version: "3"
volumes:
  mongodb_data:
    external: false

networks:
  cocoannotator:
    external: false

services:
  webserver:
    image: jsbroks/coco-annotator:webserver-stable
    container_name: annotator_webclient
    restart: always
    ports:
      - "5000:5000"
    [...]
    depends_on:
      - database
      - workers
    networks:
      - cocoannotator
  workers:
    container_name: annotator_workers
    image: jsbroks/coco-annotator:workers-stable
    [...]
    depends_on:
      - messageq
      - database
    networks:
      - cocoannotator
  messageq:
    image: rabbitmq:3
    container_name: annotator_message_q
    [...]
    networks:
      - cocoannotator
  database:
    image: mongo:4.0
    container_name: annotator_mongodb
    restart: always
    [...]
    networks:
      - cocoannotator
  letsencrypt:
     image: linuxserver/letsencrypt
     container_name: letsencrypt
     network_mode: host
     restart: always
     ports:
         - 80:80
         - 443:443
     volumes:
         - ./config:/config
     environment:
         # Domain name
         - URL=my-website-name.com
         - TZ=America/New_York
         - PGID=1000
         - PUID=1000
         # Subdomains to encrypt
         - SUBDOMAINS=www,annotator
     cap_add:
         - NET_ADMIN

它在本地文件夹中为./config/nginx/site-confs/default生成一个配置文件。

server {
        listen 80;
        server_name my-website-name.com www.my-website-name.com;
        return 301 https://$host$request_uri;
}

server {
        listen 443 ssl;
        server_name _;

        root /config/www;
        include /config/nginx/ssl.conf;

        location / {
                index index.html index.htm;
                include /config/nginx/proxy.conf;
        }
}

server {
        listen 443 ssl;
        server_name annotator.*;

        include /config/nginx/ssl.conf;

        location / {
                include /config/nginx/proxy.conf;
                proxy_pass http://localhost:5000/;
        }
        location /socket.io {
                include /config/nginx/proxy.conf;
                proxy_buffering off;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                proxy_pass http://localhost:5000/socket.io;
        }
}

我在docker-compose.yml和conf中编辑的唯一一行是添加我自己的网站名称（ my-website-name.com ）。 conf 文件似乎暴露http://localhost:5000/这是正确的。

我不确定我错过了什么。 我找不到任何防火墙等。

>$ sudo ufw status
Status: inactive

这是我尝试遵循的说明，这里有更多讨论。

更新：
这里是netstat -anp | grep -i listen netstat -anp | grep -i listen

(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::5000                 :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
unix  2      [ ACC ]     STREAM     LISTENING     147252   -                    @/containerd-shim/moby/237614275f32621bfd15c8687fca24c735e48daeffd655ee6fe00fad5ca5d9ca/shim.sock@
unix  2      [ ACC ]     SEQPACKET  LISTENING     12687    -                    /run/udev/control
unix  2      [ ACC ]     STREAM     LISTENING     123417   31697/systemd        /run/user/1000/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     123421   31697/systemd        /run/user/1000/gnupg/S.gpg-agent.extra
unix  2      [ ACC ]     STREAM     LISTENING     123422   31697/systemd        /run/user/1000/snapd-session-agent.socket
unix  2      [ ACC ]     STREAM     LISTENING     123423   31697/systemd        /run/user/1000/gnupg/S.gpg-agent.ssh
unix  2      [ ACC ]     STREAM     LISTENING     123424   31697/systemd        /run/user/1000/gnupg/S.gpg-agent.browser
unix  2      [ ACC ]     STREAM     LISTENING     123425   31697/systemd        /run/user/1000/gnupg/S.dirmngr
unix  2      [ ACC ]     STREAM     LISTENING     123426   31697/systemd        /run/user/1000/gnupg/S.gpg-agent
unix  2      [ ACC ]     STREAM     LISTENING     141776   -                    @/containerd-shim/moby/b943888c331bf79cd6c1e2f7171a5961dddbb9ae163cfa1f27d2e7b6d4662444/shim.sock@
unix  2      [ ACC ]     STREAM     LISTENING     17631    -                    @irqbalance924.sock
unix  2      [ ACC ]     STREAM     LISTENING     141767   -                    @/containerd-shim/moby/6422696dfae2f404290918b4afff5a9e65155ed1ec333bc0e72994b565e702d5/shim.sock@
unix  2      [ ACC ]     STREAM     LISTENING     145693   -                    @/containerd-shim/moby/fb9846bebcc81350c98c47f2c15811526cca22c30a0945ae7c227f921a305cce/shim.sock@
unix  2      [ ACC ]     STREAM     LISTENING     16691    -                    /var/lib/lxd/unix.socket
unix  2      [ ACC ]     STREAM     LISTENING     16571    -                    /var/run/dbus/system_bus_socket
unix  2      [ ACC ]     STREAM     LISTENING     16645    -                    /run/uuidd/request
unix  2      [ ACC ]     STREAM     LISTENING     16647    -                    /run/snapd.socket
unix  2      [ ACC ]     STREAM     LISTENING     16649    -                    /run/snapd-snap.socket
unix  2      [ ACC ]     STREAM     LISTENING     16651    -                    /run/acpid.socket
unix  2      [ ACC ]     STREAM     LISTENING     16653    -                    @ISCSIADM_ABSTRACT_NAMESPACE
unix  2      [ ACC ]     STREAM     LISTENING     141079   -                    @/containerd-shim/moby/31e14e9fa86fef5166d10363c9a4dd136af9f67f8c0d6f4bf79ebac50a474452/shim.sock@
unix  2      [ ACC ]     STREAM     LISTENING     12676    -                    /run/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     12690    -                    /run/lvm/lvmpolld.socket
unix  2      [ ACC ]     STREAM     LISTENING     12702    -                    /run/systemd/journal/stdout
unix  2      [ ACC ]     STREAM     LISTENING     43836    -                    /run/containerd/containerd.sock
unix  2      [ ACC ]     STREAM     LISTENING     44186    -                    /var/run/docker.sock
unix  2      [ ACC ]     STREAM     LISTENING     44343    -                    /var/run/docker/metrics.sock
unix  2      [ ACC ]     STREAM     LISTENING     45208    -                    /var/run/docker/libnetwork/ef4bf6e21227.sock
unix  2      [ ACC ]     STREAM     LISTENING     12891    -                    /run/lvm/lvmetad.socket

1 个解决方案

解决方案1
 0  2021-10-05 12:46:07

我设法通过添加外部网络使其在本地运行，并将letsencrypt（现在是SWAG）添加到该外部网络和cocoannotator网络并删除network_mode: "host" （我相信这意味着它使用默认的“bridge”？ )

docker-compose.yml的内容：

version: "3"
volumes:
  mongodb_data:
    external: false

networks:
  cocoannotator:
    external: false
  external_net:
    external: true

services:
  letsencrypt:
    image: linuxserver/swag
    container_name: letsencrypt
    ports:
      - 80:80
      - 443:443
    restart: always
    volumes:
        - ./config:/config
    environment:
        # Domain name
        - URL=domain.com
        - TZ=Europe/London
        - PGID=1000
        - PUID=1000
        # Subdomains to encrypt
    cap_add:
        - NET_ADMIN
    networks:
      - external_net
      - cocoannotator

  webserver:
    image: jsbroks/coco-annotator:webserver-stable
    container_name: annotator_webclient
    restart: always
    environment:
      - SECRET_KEY=RandomSecretKeyHere
      - FILE_WATCHER=true
      - ALLOW_REGISTRATION=false
    volumes:
      - "./datasets:/datasets"
      - "./models:/models"
    depends_on:
      - database
      - workers
    networks:
      - cocoannotator
  workers:
    container_name: annotator_workers
    image: jsbroks/coco-annotator:workers-stable
    volumes:
      - "./datasets:/datasets"
    depends_on:
      - messageq
      - database
    networks:
      - cocoannotator
  messageq:
    image: rabbitmq:3
    container_name: annotator_message_q
    environment:
      - RABBITMQ_DEFAULT_USER=user
      - RABBITMQ_DEFAULT_PASS=password
    networks:
      - cocoannotator
  database:
    image: mongo:4.0
    container_name: annotator_mongodb
    restart: always
    environment:
      - MONGO_DATA_DIR=/data/db
      - MONGO_LOG_DIR=/dev/null
    volumes:
      - "mongodb_data:/data/db"
    command: "mongod --smallfiles --logpath=/dev/null"
    networks:
      - cocoannotator

这里是 config\nginx\site-confs\default：

server {
    listen 80;
    server_name _;
    return 301 https://$host$request_uri;
}

server {
        listen 443 ssl;
        server_name domain.com;

        include /config/nginx/ssl.conf;

        location / {
                include /config/nginx/proxy.conf;
                proxy_pass http://webserver:5000/;
        }
        location /socket.io {
                include /config/nginx/proxy.conf;
                proxy_buffering off;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                proxy_pass http://webserver:5000/socket.io;
        }
}

将letsencrypt 服务添加到cocoannotator 网络可以让您使用“webserver”作为主机名，因为从技术上讲它不是“localhost”。

暂无
暂无

声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

相关问题 无法使用浏览器在端口 80 上的 EC2 上的 docker 中访问 Apache 如何使用来自 ACM 的 AWS 证书通过亚马逊 EC2 从端口 80 重定向到 443？ AWS-无法通过443端口访问EC2实例 即使完全设置，也无法从 ec2 aws 访问端口 80、443、5432 无法在 ubuntu AWS EC2 服务器上到达 nginx 在端口80上访问AWS EC2中的wordpress。无法连接到端口80 WebSocket端口80/443 EC2和Erlang的Cowboy AWS EC2 iptables端口80（http） AWS EC2 端口 80 连接被拒绝 如何在 AWS EC2 上打开端口 80
相关标签
 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM