How to use Nginx to proxy multiple application sites in Docker

How to proxy (how to communicate between containers)?

Just use the proxy function of nginx directly (see related capabilities separately). The troublesome thing here is the communication between docker containers.

docker There are 4 main ways to communicate between containers:

-Access through container ip: After the container is restarted, the ip will change.

- Access through the host's ip:port: If the host's IP changes, each application must be changed and the port must be bound, which is troublesome.

- Establish links through link: too tightly dependent on each other, which is not conducive to maintenance.

- Custom network: Containers in the same bridge network can access each other.

Obviously, we will choose a custom network method to link related applications to the same network. In this way, there is actually no dependence between applications and applications, agents and proxies. It is not only easy to maintain, but also easy to migrate. . Configuration is not troublesome, just replace the regular IP or domain name with the corresponding container name.

1. Unified network

Then, first you need to create a shared bridge network:

docker network create proxy-network

# 查看
docker network ls

2. Proxy service Container

Create an nginx service container specifically for proxy, named: proxy-nginx, built here using docker-compose, and its final directory structure is as follows:

proxy-nginx
├── docker-compose.yml
├── logs # 日志
│  └── error.log
├── nginx
│  ├── dockerfile
│  ├── nginx.conf
│  └── startup.sh
├── sites # 被代理站点配置
│  ├── baipiaoquan.com.conf
│  └── chaohuahui.com.conf
└── ssl # 证书文件
  └── baipiaoquan.com.pem

Some files are generated during the subsequent running process. During configuration, you only need to create the necessary files and directories.

docker-compose.yml

version: "3"

networks:
 default:
  external:
   name: proxy-network

services:
 nginx:
  build:
   context: ./nginx
  volumes:
   - ./logs:/var/log/nginx
   - ./sites:/etc/nginx/sites-available
   - ./ssl:/etc/nginx/ssl
  ports:
   - "80:80"
   - "443:443"

Bind the external ports 80 and 443 to the proxy server, and all applications can come in from here.

dockerfile

from nginx:alpine

label maintainer="chuoke"

copy nginx.conf /etc/nginx/

run apk update
  && apk upgrade
  && apk add --no-cache openssl
  && apk add --no-cache bash

run set -x ;
  addgroup -g 82 -s www-data ;
  adduser -u 82 -d -s -g www-data www-data && exit 0 ; exit 1

add ./startup.sh /opt/startup.sh

run sed -i 's/.//g' /opt/startup.sh

cmd ["/bin/bash", "/opt/startup.sh"]

expose 80 443

The running user group and user www-data will be created here to facilitate configuration and control. This name will be used in the configuration of nginx.

nginx.conf

user www-data;
worker_processes 4;
pid /run/nginx.pid;
daemon off;

events {
 worker_connections 2048;
 multi_accept on;
 use epoll;
}

http {
 server_tokens off;
 sendfile on;
 tcp_nopush on;
 tcp_nodelay on;
 keepalive_timeout 15;
 types_hash_max_size 2048;
 client_max_body_size 20m;
 include /etc/nginx/mime.types;
 default_type application/octet-stream;
 access_log /dev/stdout;
 error_log /dev/stderr;

 gzip on;
 gzip_disable "msie6";

 ssl_protocols tlsv1 tlsv1.1 tlsv1.2;
 ssl_ciphers 'ecdhe-ecdsa-chacha20-poly1305:ecdhe-rsa-chacha20-poly1305:ecdhe-ecdsa-aes128-gcm-sha256:ecdhe-rsa-aes128-gcm-sha256:ecdhe-ecdsa-aes256-gcm-sha384:ecdhe-rsa-aes256-gcm-sha384:dhe-rsa-aes128-gcm-sha256:dhe-rsa-aes256-gcm-sha384:ecdhe-ecdsa-aes128-sha256:ecdhe-rsa-aes128-sha256:ecdhe-ecdsa-aes128-sha:ecdhe-rsa-aes256-sha384:ecdhe-rsa-aes128-sha:ecdhe-ecdsa-aes256-sha384:ecdhe-ecdsa-aes256-sha:ecdhe-rsa-aes256-sha:dhe-rsa-aes128-sha256:dhe-rsa-aes128-sha:dhe-rsa-aes256-sha256:dhe-rsa-aes256-sha:ecdhe-ecdsa-des-cbc3-sha:ecdhe-rsa-des-cbc3-sha:edh-rsa-des-cbc3-sha:aes128-gcm-sha256:aes256-gcm-sha384:aes128-sha256:aes256-sha256:aes128-sha:aes256-sha:des-cbc3-sha:!dss';

 include /etc/nginx/conf.d/*.conf;
 include /etc/nginx/sites-available/*.conf;

 open_file_cache off; # disabled for issue 619
 charset utf-8;
}

Just copy the default content of nginx. What needs to be changed is the running user name. Note that the user name must be consistent with the previous setting.

startup.sh

#!/bin/bash

# start crond in background
crond -l 2 -b

# start nginx in foreground
nginx

This is used to start the nginx program. The content is currently relatively small, mainly for the convenience of future content expansion.

Start the proxy service container

docker-compose up -d nginx

Check whether the startup is normal docker-compose ps, if not, check whether there are any errors in the configuration.

That’s it, leave it alone for now and go create the application.

3. Add application

Add a site https://baipiaoquan.com/.

Configuring application containers

Also use docker-compose to create applications.

This is a php project, so this application requires at least two service containers, nginx and php-fpm. The project directory structure is as follows:

baipiaoquan/
├── docker-compose.yml
├── log
│  └── nginx
│    └── error.log
├── nginx
│  ├── dockerfile
│  ├── log
│  ├── nginx.conf
│  ├── sites
│  │  └── baipiaoquan.com.conf
│  ├── ssl
│  │  ├── baipiaoquan.com.key
│  │  ├── baipiaoquan.com.pem
│  └── startup.sh
└── php-fpm
  ├── dockerfile
  └── php.ini

docker-compose.yml

version: '3'

networks:
 proxy:
  external:
    name: ${proxy_network_name}
 backend:
  driver: ${networks_driver}

services:
 php-fpm:
   build:
    context: ./php-fpm
   volumes:
    - ./php-fpm/php.ini:/usr/local/etc/php/php.ini
    - ${app_code_path_host}:${app_code_path_container}${app_code_container_flag}
   networks:
    - backend

 nginx:
   build:
    context: ./nginx
    args:
     - php_upstream_container=${nginx_php_upstream_container}
     - php_upstream_port=${nginx_php_upstream_port}
   volumes:
    - ${app_code_path_host}:${app_code_path_container}${app_code_container_flag}
    - ./log:/var/log/nginx
    - ./sites:/etc/nginx/sites-available
    - ./ssl:/etc/nginx/ssl
   container_name: ${compose_project_name}_nginx
   depends_on:
    - php-fpm
   networks:
    - proxy
    - backend

In order to facilitate adjustment, environment variables are used here.

Note the container name of nginx container_name: ${compose_project_name}_nginx. This value is critical and will be used in subsequent proxies.

.env

# 宿主机中代码的位置
app_code_path_host=../

# 容器中代码的位置
app_code_path_container=/var/www

# 这个是抄的 laradock
app_code_container_flag=:cached

# 选择机器上的存储路径。适用于所有储存系统
data_path_host=~/.baipiaoquan/data

### drivers ################################################

# all volumes driver 
volumes_driver=local 

# 网络驱动 
networks_driver=bridge 

# 代理网络名称，这是前面创建的 
proxy_network_name=proxy-network

### docker compose files ##################################
# 
compose_file=docker-compose.yml

# change the separator from : to ; on windows
compose_path_separator=:

# 项目名称
compose_project_name=baipiaoquan

The proxy network name used is: proxy-network, which was created earlier;
nginx’s container name will be: baipiaoquan_nginx.

nginx’s dockerfile

This file can be directly taken from the previous one, and then added about PHP related information.

from nginx:alpine

copy nginx.conf /etc/nginx/

run apk update
  && apk upgrade
  && apk --update add logrotate
  && apk add --no-cache openssl
  && apk add --no-cache bash

run set -x ;
  addgroup -g 82 -s www-data ;
  adduser -u 82 -d -s -g www-data www-data && exit 0 ; exit 1

arg php_upstream_container=php-fpm
arg php_upstream_port=9000

# set upstream conf and remove the default conf
run echo "upstream php-upstream { server ${php_upstream_container}:${php_upstream_port}; }" > /etc/nginx/conf.d/upstream.conf
  && rm /etc/nginx/conf.d/default.conf

add ./startup.sh /opt/startup.sh
run sed -i 's/.//g' /opt/startup.sh

cmd ["/bin/bash", "/opt/startup.sh"]

expose 80 443

php-fpm’s dockerfile

from php:7.3-fpm

arg puid=1000

env puid ${puid}

arg pgid=1000

env pgid ${pgid}

run groupmod -o -g ${pgid} www-data &&
  usermod -o -u ${puid} -g www-data www-data

expose 9000

workdir /var/www

cmd ["php-fpm"]

Don’t forget the php.ini file, you can also use its default, then delete this related configuration.

Service baipiaoquan.com.conf configuration

server {

  listen 80 default_server;

  # for https
  listen 443 ssl default_server;
  ssl_certificate /etc/nginx/ssl/3243258_baipiaoquan.com.pem;
  ssl_certificate_key /etc/nginx/ssl/3243258_baipiaoquan.com.key;
  ssl_session_timeout 5m;
  ssl_protocols tlsv1 tlsv1.1 tlsv1.2;
  ssl_ciphers ecdhe-rsa-aes128-gcm-sha256:high:!anull:!md5:!rc4:!dhe; 
  ssl_prefer_server_ciphers on;

  add_header x-frame-options "sameorigin";
  add_header x-xss-protection "1; mode=block";
  add_header x-content-type-options "nosniff";

  # localhost 一定要
  server_name localhost baipiaoquan.com www.baipiaoquan.com;
  root /var/www/; # 这个和前面的配置保持一致
  index index.php index.html index.htm;

  location / {
     try_files $uri $uri/ /index.php$is_args$args;
  }

  location ~ .php$ {
    try_files $uri /index.php =404;
    fastcgi_pass php-upstream; # 这个是 nginx dockerfile 里配置的
    fastcgi_index index.php;
    fastcgi_buffers 16 16k;
    fastcgi_buffer_size 32k;
    fastcgi_param script_filename $document_root$fastcgi_script_name;
    #fixes timeouts
    fastcgi_read_timeout 600;
    include fastcgi_params;
  }

  location ~ /.ht {
    deny all;
  }

  location /.well-known/acme-challenge/ {
    root /var/www/letsencrypt/;
    log_not_found off;
  }
}

I have it all configured here, but it can actually be streamlined and only need to be configured.

Start the application

At this point, you can start the service of baipiaoquan.com. Run it in the directory of baipiaoquan:

docker-compose up -d nginx

If nothing unexpected happens, the application should start and be able to receive services. You can also test it by entering the container and accessing localhost to see if the result is what you want. I tested it like this:

docker-compose exec nginx wget localhost

Then look at the size of the returned data and judge whether it was successful based on the situation.
You can check whether the application is successfully connected to the proxy-network through the following command:

docker network inspect proxy-network

The next step is to make this application accessible to people all over the world.

Add proxy configuration to nginx-proxy

Note: You must start the application first, and then start the proxy, otherwise nginx cannot find the upstream error.

Storage location: proxy-nginx/sites/baipiaoquan.com.conf, just copy the above configuration and change a few places. The final configuration is as follows:

# 我这配的仅支持 https，如果没要求，这个就不需要 

server {
  listen 80;
  server_name baipiaoquan.com www.baipiaoquan.com;
  return 301 https://$host$request_uri; 
}

server {

  # 如果是 http 就配置这个
  # listen 80 default_server;

  # 如果是 https 就配置这个
  listen 443 ssl;
  ssl_certificate      /etc/nginx/ssl/3243258_baipiaoquan.com.pem;
  ssl_certificate_key    /etc/nginx/ssl/3243258_baipiaoquan.com.key;
  ssl_session_timeout    5m;
  ssl_protocols       tlsv1 tlsv1.1 tlsv1.2;
  ssl_ciphers        ecdhe-rsa-aes128-gcm-sha256:ecdhe:ecdh:aes:high:!null:!anull:!md5:!adh:!rc4;
  ssl_prefer_server_ciphers on;

  server_name baipiaoquan.com www.baipiaoquan.com;

  add_header x-frame-options "sameorigin";
  add_header x-xss-protection "1; mode=block";
  add_header x-content-type-options "nosniff";

  location / {
    proxy_set_header host        $host;
    proxy_set_header x-real-ip      $remote_addr;
    proxy_set_header x-forwarded-for   $proxy_add_x_forwarded_for;
    proxy_set_header x-forwarded-proto  $scheme;
    proxy_set_header x-forwarded-host  $host;
    proxy_set_header x-forwarded-port  $server_port;
    proxy_pass http://baipiaoquan_nginx/; # 这个值就是应用 nginx 的容器名称
  }
}

Reload the proxy Server configuration, run in the nginx-proxy directory:

# 先测试下配置文件，这步一定要执行成功
docker-compose exec nginx nginx -t

# 如果提示成功，则重新加载，否则就按提示检查修改配置文件
docker-compose exec nginx nginx -s reload

Wait a moment, if everything goes well, people all over the world should now be able to access this https://baipiaoquan.com/ website.

If you need to add other applications, the logic and process will be the same. For example, I added another application: https://chaohhuahui.com/, and I can ping their IP addresses to see that they are the same.

The above is the detailed content of How to use Nginx to proxy multiple application sites in Docker. For more information, please follow other related articles on the PHP Chinese website!