Docker nginx部署阿里https(最新的方案)

「爱情、让人受尽委屈。」 2023-06-18 15:53 14阅读 0赞

## 1.安装nginx ##

docker pull nginx

## 2.启动容器（注意80跟443，自己注意下自己的服务器 80.443端口有没有打开） ##

docker run --name nginx -d -p 80:80 -p 443:443 nginx

## 3.测试 ##

浏览器 ip

## 4.进入容器 ##

docker exec -it nginx /bin/bash

## 5.在etc/nginx下创建一个目录 cert ##

cd erc/nginx
    mkdir cert

## 6.把证书放到cert目录下 ##

docker cp  xianbao.pem  nginx:/etc/nginx/cert/xianbao.pem
    docker cp  xianbao.key  nginx:/etc/nginx/cert/xianbao.key

## 7.把容器的nginx.conf文件拉出来修改 ##

docker cp   nginx:/etc/nginx/nginx.conf nginx.conf

# 查询已经部署的tomcat的内网ip地址（再配置文件中） #

docker inspect mytomcat1|grep "IPAddress"

## 8.修改nginx.conf ##

user  nginx;
    worker_processes  1;
    
    error_log  /var/log/nginx/error.log warn;
    pid        /var/run/nginx.pid;
    
    events { 
        worker_connections  1024;
    }
    
    http { 
        include       /etc/nginx/mime.types;
        default_type  application/octet-stream;
        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';
        access_log  /var/log/nginx/access.log  main;
        sendfile        on;
        #tcp_nopush on;
        keepalive_timeout  65;
        #开启压缩,提高网站的访问销量
        gzip on;
    	gzip_min_length 1k;
    	gzip_buffers 4 16k;
    	#gzip_http_version 1.0;
    	gzip_comp_level 2;
    	gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
    	gzip_vary off;
    	gzip_disable "MSIE [1-6]\.";
        #include /etc/nginx/conf.d/*.conf;
        upstream tomcat_client { 
             server 172.17.0.6:8080;#修改为自己tomcat的内网ip端口
        } 
        server { 
            server_name www.xianbaovip.com;  #域名
            listen 80 default_server;
            listen [::]:80 default_server ipv6only=on;
            location / { 
                proxy_pass http://tomcat_client;
                proxy_redirect default;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
            }
        }
        server { 
                listen 443;
                server_name www.xianbaovip.com;  #域名
                ssl on;
                root html;
                index index.html index.htm;
                ssl_certificate   /etc/nginx/cert/xianbao.pem; #修改为自己证书的路径
                ssl_certificate_key  /etc/nginx/cert/xianbao.key;#修改为自己证书的路径
                ssl_session_timeout 5m;
                ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
                ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
                ssl_prefer_server_ciphers on;
                location / { 
                    proxy_pass http://tomcat_client;
                proxy_redirect default;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                }
            }
    }

## 9.nginx.conf覆盖到容器中 ##

docker cp nginx.conf  nginx:/etc/nginx/nginx.conf

## 10.重启nginx ##

docker restart nginx

## 修改tocmat的server.xml（自行修改） ##

主要是：proxyPort="443"这句要加上，然后重启tomcat 然后就配置好了

## 番外 让nginx80端口强制跳转443（把server listen端口替换成这端） ##

server { 
            listen 80;
            server_name  www.xianbaovip.com;#域名
            #告诉浏览器有效期内只准用 https 访问
            add_header Strict-Transport-Security max-age=15768000;
            #永久重定向到 https 站点
            return 301 https://www.xianbaovip.com$request_uri;#域名
        }