使用Traefik或NGINX正确处理Docker Swarm上的Socket.io

分类：编程问答

如何解决使用Traefik或NGINX正确处理Docker Swarm上的Socket.io

我正在使用通过Docker Swarm部署的Socket.IO在Node.js中的应用程序上工作，我希望可以选择应用程序服务的多个实例。但是，当存在多个实例时，应用程序将失败。失败涉及浏览器中每个Socket.IO消息的错误，应该在消息中发送的数据永远不会到达，等等。

Docker Stack文件具有四个服务

  • Node.js应用程序
  • 在多节点Socket.IO服务中处理Socket.IO和会话所需的REDIS实例-是的，我已经阅读了关于此的Socket.IO文档，实现了connect-redis SessionStore，并使用了socket.io-redis做多节点Socket.IO
  • 数据库（MySQL）
  • 反向代理-我同时使用了NGINX和Traefik

在Socket.IO中，有一个例行的keepalive请求，例如/socket.io/?EIO=3&transport=polling&t=NLjcKJj&sid=X5UnuTjlYNJ4N8OsAAAH上的GET。该请求在反向代理的日志文件中可见，并由应用程序处理。 Engine.IO的调试输出表明它收到了这些请求。

特别是：

2020-10-28T05:06:02.557Z Net read redis:6379 id 0
2020-10-28T05:06:02.557Z socket.io:socket socket connected - writing packet
2020-10-28T05:06:02.557Z socket.io:socket joining room X5UnuTjlYNJ4N8OsAAAH
2020-10-28T05:06:02.557Z socket.io:client writing packet {"type":0,"nsp":"/"}
2020-10-28T05:06:02.557Z socket.io:socket joined room [ 'X5UnuTjlYNJ4N8OsAAAH' ]
2020-10-28T05:06:02.656Z engine intercepting request for path "/socket.io/"
2020-10-28T05:06:02.656Z engine handling "GET" http request "/socket.io/?EIO=3&transport=polling&t=NLjcKJj&sid=X5UnuTjlYNJ4N8OsAAAH"
2020-10-28T05:06:02.656Z engine setting new request for existing client
2020-10-28T05:06:02.655Z engine intercepting request for path "/socket.io/"
2020-10-28T05:06:02.655Z engine handling "POST" http request "/socket.io/?EIO=3&transport=polling&t=NLjcKJh&sid=X5UnuTjlYNJ4N8OsAAAH"
2020-10-28T05:06:02.655Z engine unknown sid "X5UnuTjlYNJ4N8OsAAAH"
2020-10-28T05:06:02.774Z engine intercepting request for path "/socket.io/"
2020-10-28T05:06:02.774Z engine handling "GET" http request "/socket.io/?EIO=3&transport=polling&t=NLjcKLI&sid=X5UnuTjlYNJ4N8OsAAAH"
2020-10-28T05:06:02.774Z engine unknown sid "X5UnuTjlYNJ4N8OsAAAH"
2020-10-28T05:06:02.775Z engine intercepting request for path "/socket.io/"
2020-10-28T05:06:02.775Z engine handling "POST" http request "/socket.io/?EIO=3&transport=polling&t=NLjcKLJ&sid=X5UnuTjlYNJ4N8OsAAAH"
2020-10-28T05:06:02.775Z engine setting new request for existing client
2020-10-28T05:06:02.775Z socket.io:client client close with reason transport close
2020-10-28T05:06:02.775Z socket.io:socket closing socket - reason transport close
2020-10-28T05:09:14.955Z socket.io:client client close with reason ping timeout
2020-10-28T05:09:14.955Z socket.io:socket closing socket - reason ping timeout

日志消息中显示engine unknown sid "X5UnuTjlYNJ4N8OsAAAH"似乎很重要。就是说会话ID未知。但是会话是使用REDIS在节点之间共享的。因此，令人困惑的原因是会话应该是未知的，因为应该使用connect-redis来共享会话。

另一个重要的事情是浏览器中的登录。

在JavaScript控制台中，会连续报告以下消息：

WebSocket connection to 'ws://DOMAIN-NAME/socket.io/?EIO=3&transport=websocket&sid=h2aFFkOvNZtFc1DcAAAI' failed: WebSocket is closed before the connection is established.
Failed to load resource: the server responded with a status of 400 (Bad Request)

最后一个报告为发生在http://DOMAIN-NAME/socket.io/?EIO=3&transport=polling&t=NLjf5hB&sid=h2aFFkOvNZtFc1DcAAAI

然后，对于这些请求，我看到响应主体为：

{
    "code": 1,"message": "Session ID unknown"
}

这显然与之前的unknown sid消息一致。我认为那是因为服务器认为会话ID不正确，所以连接已关闭。

在我对此进行的研究中，我了解到在Docker Swarm中，流量是以循环方式分布的-这就是说Docker Swarm充当了循环负载平衡器。在这种情况下，Socket.IO的成功途径是实现粘性会话。

我在某处读到NGINX中的粘性会话支持不适用于这种情况，而Traefik可以支持这种情况。

在NGINX中，我具有以下代理配置：

location / {

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header X-NginX-Proxy false;

    proxy_pass http://todos;
    proxy_redirect off;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

upstream todos {
    ip_hash;

    server todo:80  fail_timeout=1s max_fails=3;
    keepalive 16;
}

那并没有改变行为-仍然是unknown sid等。因此，我已经切换到Traefik，并且在Traefik的这一端找不到文档。这是我第一次使用FWIW Traefik。我可以使用Lets Encrypt来实现HTTPS，但不能使用粘性会话。

要配置Traefik，我使用命令行参数和Docker容器标签，以便整个配置位于Docker Stack文件中。

    traefik:
        image: traefik:v2.0
        restart: always
        ports:
            - "80:80" # <== http
            - "8080:8080" # <== :8080 is where the dashboard runs on
            - "443:443" # <== https
        deploy:
            replicas: 1
            labels:
                #### Labels define the behavior and rules of the traefik proxy for this container ####
                - "traefik.enable=true" # <== Enable traefik on itself to view dashboard and assign subdomain to view it
                - "traefik.http.routers.api.rule=Host(`monitor.DOMAIN-NAME`)" # <== Setting the domain for the dashboard
                - "traefik.http.routers.api.service=api@internal" # <== Enabling the api to be a service to access
                - "traefik.http.routers.api.entrypoints=web"
            placement:
                constraints:
                    - "node.hostname==srv1"
        command:
            - "--providers.docker.swarmmode=true"
            - "--providers.docker.endpoint=unix:///var/run/docker.sock"
            - "--providers.docker.watch=true"
            - "--log.level=DEBUG"
            - "--accesslog=true"
            - "--tracing=true"
            - "--api.insecure=true" # <== Enabling insecure api,NOT RECOMMENDED FOR PRODUCTION
            - "--api.dashboard=true" # <== Enabling the dashboard to view services,middlewares,routers,etc...
            - "--providers.docker=true" # <== Enabling docker as the provider for traefik
            - "--providers.docker.exposedbydefault=false" # <== Don't expose every container to traefik,only expose enabled onesconfiguration file
            - "--providers.docker.network=todo_webnet" # <== Operate on the docker network named web
            - "--entrypoints.web.address=:80" # <== Defining an entrypoint for port :80 named web
            - "--entrypoints.web-secured.address=:443" # <== Defining an entrypoint for https on port :443 named web-secured
            - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=false" # <== Enable TLS-ALPN-01 to generate and renew ACME certs
            - "--certificatesresolvers.mytlschallenge.acme.email=E-MAIL-ADDRESS@DOMAIN-NAME" # <== Setting email for certs
            - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json" # <== Defining acme file to store cert 
            - "--certificatesresolvers.mytlschallenge.acme.httpChallenge.entryPoint=web"
        volumes:
            - /home/ubuntu/letsencrypt:/letsencrypt # <== Volume for certs (TLS)
            - /var/run/docker.sock:/var/run/docker.sock # <== Volume for docker admin
        networks:
            - webnet

    todo:
        image: robogeek/todo-app:first-dockerize-redis
        # ports: 
        #    - "80:80"
        networks:
            - dbnet
            - webnet
            - redisnet
        deploy:
            replicas: 2
            labels:
                #### Labels define the behavior and rules of the traefik proxy for this container ####
                - "traefik.enable=true" # <== Enable traefik to proxy this container
                - "traefik.http.routers.todo.rule=Host(`DOMAIN-NAME`)" # <== Your Domain Name goes here for the http rule
                - "traefik.http.routers.todo.entrypoints=web" # <== Defining the entrypoint for http,**ref: line 30
                - "traefik.http.routers.todo.service=todo"
                - "traefik.http.services.todo.loadbalancer.healthcheck.port=80"
                - "traefik.http.services.todo.loadbalancer.sticky=true"
                - "traefik.http.services.todo.loadbalancer.server.port=80"
                - "traefik.http.routers.todo-secured.rule=Host(`DOMAIN-NAME`)" # <== Your Domain Name goes here for the http rule
                - "traefik.http.routers.todo-secured.entrypoints=web-secured" # <== Defining the entrypoint for http,**ref: line 30
                - "traefik.http.routers.todo-secured.service=todo"
                - "traefik.http.routers.todo-secured.tls=true"
                - "traefik.http.routers.todo-secured.tls.certresolver=mytlschallenge" # <== Defining certsresolvers for https
                # - "traefik.http.routers.todo-app.middlewares=redirect@file" # <== This is a middleware to redirect to https
                # - "traefik.http.routers.nginx-secured.rule=Host(`example.com`)" # <== Your Domain Name for the https rule 
                # - "traefik.http.routers.nginx-secured.entrypoints=web-secured" # <== Defining entrypoint for https,**ref: line 31
        depends_on:
            - db
            - redis
        dns:
            - 8.8.8.8
            - 9.9.9.9
        environment:
            - SEQUELIZE_CONNECT=models/sequelize-mysql-docker.yaml
            - SEQUELIZE_DBHOST=db
            - SEQUELIZE_DBNAME=tododb
            - SEQUELIZE_DBUSER=dbuser
            - SEQUELIZE_DBPASSWD=PASS-WORD-HIDDEN
            - REDIS_ENDPOINT=redis
            - NODE_DEBUG=redis
            - REDIS_PASSWD=PASS-WORD-HIDDEN
            - DEBUG=todos:*,ioredis:*,socket.io:*,engine
        command: [ "./wait-for-it.sh","-t","0","db:3306","--","node","./app.mjs" ]

解决方法

在Traefik论坛上，我发现：https://community.traefik.io/t/sticky-sessions-dont-work/1949

在讨论中，我将以下label添加到了todo容器中：

- "traefik.http.services.todo.loadbalancer.sticky.cookie.name=StickySessionCookie"

现在它可以正常工作，到目前为止可以从1个容器扩展到4个容器，并且运行良好。

,

以防万一有人在 HTTPS 模式下运行。这是我的配置：

在 labels 部分的 docker-compose 文件中：

      - "traefik.http.services.<service-name>.loadbalancer.sticky=true"
      - "traefik.http.services.<service-name>.loadbalancer.sticky.cookie.name=StickyCookie"
      - "traefik.http.services.<service-name>.loadbalancer.sticky.cookie.secure=true"
  • 注意：您可以将 StickyCookie 更改为您想要的任何值。

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。

相关推荐

导入项目后报错问题
依赖报错 idea导入项目后依赖报错，解决方案：https://blog.csdn.net/weixin_42420249/article/details/81191861 依赖版本报错：更换其他版本 无法下载依赖可参考：https://blog.csdn.net/weixin_42628809/a
idea不能识别yaml文件
使用mybatis plus常见错误
错误1：代码生成器依赖和mybatis依赖冲突 启动项目时报错如下 2021-12-03 13:33:33.927 ERROR 7228 [ main] o.s.b.d.LoggingFailureAnalysisReporter : *************************** APPL
gradle常见问题与错误
错误1：gradle项目控制台输出为乱码 # 解决方案：https://blog.csdn.net/weixin_43501566/article/details/112482302 # 在gradle-wrapper.properties 添加以下内容 org.gradle.jvmargs=-Df
Mybatis Plus传入参数0不起作用
错误还原：在查询的过程中，传入的workType为0时，该条件不起作用 &lt;select id=&quot;xxx&quot;&gt; SELECT di.id, di.name, di.work_type, di.updated... &lt;where&gt; &lt;if test=&qu
linux中make编译源码包失败
报错如下，gcc版本太低 ^ server.c:5346:31: 错误：‘struct redisServer’没有名为‘server_cpulist’的成员 redisSetCpuAffinity(server.server_cpulist); ^ server.c: 在函数‘hasActiveC
微服务启动错误：Command line is too long. Shorten command line for
解决方案1 1、改项目中.idea/workspace.xml配置文件，增加dynamic.classpath参数 2、搜索PropertiesComponent，添加如下 &lt;property name=&quot;dynamic.classpath&quot; value=&quot;tru
vue常见错误
删除根组件app.vue中的默认代码后报错：Module Error (from ./node_modules/eslint-loader/index.js): 解决方案：关闭ESlint代码检测，在项目根目录创建vue.config.js，在文件中添加 module.exports = { lin
spark常见错误
查看spark默认的python版本 [root@master day27]# pyspark /home/software/spark-2.3.4-bin-hadoop2.7/conf/spark-env.sh: line 2: /usr/local/hadoop/bin/hadoop: No s
matplotlib报错：AttributeError: module 'backend_interagg' has no attribute 'FigureCanvas'. Did you mean: 'FigureCanvasAgg'?
使用本地python环境可以成功执行 import pandas as pd import matplotlib.pyplot as plt # 设置字体 plt.rcParams[&#39;font.sans-serif&#39;] = [&#39;SimHei&#39;] # 能正确显示负号 p
gitlab登录失败，报错：This challenge page was accidentally cached by an intermediary and is no longer available.
设置时间 控制面板
后端开发常见错误
错误1：Request method ‘DELETE‘ not supported 错误还原：controller层有一个接口，访问该接口时报错：Request method ‘DELETE‘ not supported 错误原因：没有接收到前端传入的参数，修改为如下 参考 错误2：cannot r
docker常见错误
错误1：启动docker镜像时报错：Error response from daemon: driver failed programming external connectivity on endpoint quirky_allen 解决方法：重启docker -&gt; systemctl r
idea常见错误
错误1：private field ‘xxx‘ is never assigned 按Altʾnter快捷键，选择第2项 参考：https://blog.csdn.net/shi_hong_fei_hei/article/details/88814070 错误2：启动时报错，不能找到主启动类 #
pip安装依赖失败
报错如下，通过源不能下载，最后警告pip需升级版本 Requirement already satisfied: pip in c:\users\ychen\appdata\local\programs\python\python310\lib\site-packages (22.0.4) Coll
maven常见错误
错误1：maven打包报错 错误还原：使用maven打包项目时报错如下 [ERROR] Failed to execute goal org.apache.maven.plugins:maven-resources-plugin:3.2.0:resources (default-resources)
cloud项目中常见错误
错误1：服务调用时报错 服务消费者模块assess通过openFeign调用服务提供者模块hires 如下为服务提供者模块hires的控制层接口 @RestController @RequestMapping(&quot;/hires&quot;) public class FeignControl
springboot常见错误
错误1：运行项目后报如下错误 解决方案 报错2：Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.8.1:compile (default-compile) on project sb 解决方案：在pom.
springmvc拦截器中使用redisTemplate报空指针异常
参考 错误原因 过滤器或拦截器在生效时，redisTemplate还没有注入 解决方案：在注入容器时就生效 @Component //项目运行时就注入Spring容器 public class RedisBean { @Resource private RedisTemplate&lt;String
vite报错：npm ERR! command C:WINDOWSsystem32cmd.exe /d /s /c C:UsersychenAppDataLocalTempnpx-dde1c848.cmd
使用vite构建项目报错 C:\Users\ychen\work&gt;npm init @vitejs/app @vitejs/create-app is deprecated, use npm init vite instead C:\Users\ychen\AppData\Local\npm-
pythonJavaScriptjavaHTMLPHPreactjsC#AndroidCSSNode.jssqlrpython-3.xMysqLjQueryc++pandasFlutterangularIOSdjangolinuxswifttypescript路由器JSON路由器设置无线路由器h3c华三华三路由器设置华三路由器电脑软件教程arraysdocker软件图文教程Cvue.jslaravelspring-boot