使用私有 docker 注册表运行 traefik 作为具有自签名证书的不同域上的容器

如何解决使用私有 docker 注册表运行 traefik 作为具有自签名证书的不同域上的容器

我正在尝试在反向代理（使用 Traefik v2）后面设置一个私有 Docker 注册表。

1. 我有一台计算机，在内部网络中有两个本地域
2. 私有 docker 注册表可以在没有密码的情况下工作
3. 我创建了自签名证书

没有 traefik，我可以将图像推送和拉取到域“docker-registry.mydomain.de:443”。 如果我包含 traefik，我会收到证书错误、错误的 gadway 或 404 错误。

我做错了什么？我附上了我的代码。

cat /srv/docker-compose/docker-compose.yml

version: '3.6'
services:

  docker-registry:
    image: registry:2
    #ports:
      ##- 5000:5000
    #  - 443:443
    environment:
       - REGISTRY_HTTP_SECRET="mysecret"
       - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data
       - REGISTRY_STORAGE_DELETE_ENABLED=true
       - REGISTRY_HTTP_ADDR=0.0.0.0:443
       - REGISTRY_HTTP_TLS_CERTIFICATE=/certs/docker-registry.mydomain.de.pem
       - REGISTRY_HTTP_TLS_KEY=/certs/docker-registry.mydomain.de-key.pem
    labels:
       - traefik.enable=true

       - traefik.http.routers.dr-http.entrypoints=http
       - traefik.http.routers.dr-http.rule=Host(`docker-registry.mydomain.de`)

       - traefik.http.routers.dr-http.middlewares=dr-https
       - traefik.http.middlewares.dr-https.redirectscheme.scheme=https

       - traefik.http.routers.dr.entrypoints=https
       - traefik.http.routers.dr.rule=Host(`docker-registry.mydomain.de`)
       - traefik.http.routers.dr.tls=true
       - traefik.http.services.dr.loadbalancer.server.port=443
       - traefik.docker.network=traefik-net
    volumes:
      - ./data:/data
      - ./certs:/certs
    networks:
      - traefik-net

networks:
  traefik-net:
    external: true

cat /srv/traefik/docker-compose.yml

version: '3.6'

services:
  reverse-proxy:
    image: traefik:latest
    networks:
      - traefik-net
    ports:
      - 8080:8080
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./conf:/etc/traefik
      - ./certs:/etc/ssl:ro
    labels:
      - traefik.enable=true

      - traefik.http.routers.traefik-http.entrypoints=http
      - traefik.http.routers.traefik-http.rule=Host(`traefik.mydomain.de`)

      - traefik.http.routers.traefik-http.middlewares=traefik-https
      - traefik.http.middlewares.traefik-https.redirectscheme.scheme=https

      - traefik.http.routers.traefik.entrypoints=https
      - traefik.http.routers.traefik.rule=Host(`traefik.mydomain.de`)
      - traefik.http.routers.traefik.tls=true

      - traefik.http.routers.traefik.service=api@internal

networks:
  traefik-net:
    external: true

cat /srv/traefik/conf/traefik.yml

insecureSkipVerify: true

api:
  dashboard: true
entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    watch: true

cat /srv/traefik/conf/dynamic.yml

tls:
  certificates:
    - certFile: /tools/certs/_wildcard.pem
      keyFile: /tools/certs/_wildcard-key.pem
    - certFile: /tools/certs/traefik.mydomain.de.crt
      keyFile: /tools/certs/traefik.mydomain.de.key
    - certFile: /tools/certs/docker-registry.mydomain.de.pem
      keyFile: /tools/certs/docker-registry.mydomain.de.pem

所有证书都在 /srv/traefik/certs 路径中。 证书由 mkcert 和 openssl 工具生成。

解决方法

代码中的问题是 docker 注册表只接受带有 crt 的中间.crt 扩展名，而不是 pem 或 csr。改变这一点，你就会成功。