如何在Traefik中代理Websocket

Question

我正在尝试设置Upsource以在Traefik的背后工作：https：//www.jetbrains.com/help/upsource/proxy-configuration.html

Traefik正在听端口8008和8443（因为将用于另一个80/443）：

--entryPoints='Name:http Address::8008 Redirect.EntryPoint:https' --entryPoints='Name:https Address::8443 TLS'

docker标签：

labels:
  traefik.backend: upsource
  traefik.enable: "true"
  traefik.port: "8080"
  traefik.frontend.rule: "Host:review.domain.com"

在conf/internal/bundle.properties中，base-url配置如下：

base-url=https://review.domain.com:8443/

问题：

time="2017-09-20T03:23:59Z" level=error msg="Error getting ACME certificates [review.domain.com] : Cannot obtain certificates map[review.domain.com:acme: Error 400 - urn:acme:error:connection - Connection refused
Error Detail:
        Validation for review.domain.com:443

为什么它验证端口443而不是8443？

此外

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://upsourcemachine.domain.local:1111;
        proxy_pass_header Sec-Websocket-Extensions;

您可以确认Traefik支持Websockets吗？如果是这样，如何配置？

Answer 1

traefik句柄websocket，您不需要任何特定的配置。

您的问题似乎更多地是关于让我们加密的挑战。让我们加密在其他端口以外的其他端口上没有处理TLS挑战，而Traefik中的默认挑战为TLS：

因此您需要配置Traefik来使用DNS挑战https://docs.traefik.io/configuration/acme/

Answer 2

Confluence的工作示例

version: '3.3'
networks:
  traefik:
    external: true
volumes:
  portainer_data:
  confluence:
services:
  traefik:
    image: traefik:1.7.9-alpine
    command: >
      --docker
      --docker.swarmmode
      --docker.watch
      --docker.exposedbydefault=true
      --docker.domain=example.com
      --defaultentrypoints=http,https,ws,wss
      --entrypoints='Name:http Address::80'
      --entrypoints='Name:https Address::443 TLS'
      --acme
      --acme.email='[e-mail]'
      --acme.storage='/certs/acme.json'
      --acme.entryPoint=https
      --acme.httpChallenge.entryPoint=http
      --acme.onhostrule=true
      --acme.acmelogging=true
      --logLevel=INFO
      --accessLog
      --api
    ports:
      - 80:80
      - 443:443
    networks:
      - manager
      - traefik
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /certs:/certs
    deploy:
      mode: global
      labels:
        - traefik.enable=true
        - traefik.port=8080
        - traefik.frontend.rule=Host:traefik.example.com
        - traefik.docker.network=traefik
        #- traefik.redirectorservice.frontend.entryPoints=http
        #- traefik.redirectorservice.frontend.redirect.entryPoint=https
        - traefik.webservice.frontend.entryPoints=http,https
  portainer:
    image: portainer/portainer:1.20.1
    command: -H tcp://tasks.agent:9001 --tlsskipverify
    networks:
      - manager
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    deploy:
      placement:
        constraints: [node.role == manager]
      labels:
        - traefik.enable=true
        - traefik.port=9000
        - traefik.frontend.rule=Host:portainer.example.com
        - traefik.docker.network=traefik
        #- traefik.redirectorservice.frontend.entryPoints=http
        #- traefik.redirectorservice.frontend.redirect.entryPoint=https
        - traefik.webservice.frontend.entryPoints=http,https
  agent:
    image: portainer/agent:1.2.1
    environment:
      AGENT_CLUSTER_ADDR: tasks.agent
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - manager
    deploy:
      mode: global
  confluence:
    image: cptactionhank/atlassian-confluence:6.3.4
    networks:
      - traefik
    volumes:
      - confluence:/var/atlassian/confluence
    deploy:
      replicas: 1
      labels:
        - traefik.enable=true
        - traefik.port=8090
        - traefik.frontend.rule=Host:confluence.example.com
        - traefik.docker.network=traefik
        # - traefik.redirectorservice.frontend.entryPoints=http
        # - traefik.redirectorservice.frontend.redirect.entryPoint=https
        - traefik.webservice.frontend.entryPoints=http,https,ws,wss

Answer 3

kubernetes的示例：

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: server-route
spec:
  entryPoints:
    # Defined in the traefik configuration, e.g.
    # --entrypoints.websecure.address=:8888
    - websecure
  routes:
    - match: PathPrefix(`/`)
      middlewares:
        - name: server-headers
      kind: Rule
      services:
        - name: server
          port: portname
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: server-headers
spec:
  headers:
    customRequestHeaders:
      X-Forwarded-Proto: "https"

您必须使用traefik的自定义入口对象而不是普通入口。