在traefik代理后面的docker中的gitlab失败(通常)

Question

我有几个网站在Docker中运行LetsEncrypt凭据并通过traefik路由.我想在Docker中运行一个本地gitlab-ce,类似于LetsEncrypt和traefik.

所以我把它添加到我的traefik.toml文件中:

[[acme.domains]]
  main = "gitlab.mydomain.com"

这到config/gitlab.rb:

external_url "http://gitlab.mydomain.com"

我开始使用gitlab:

docker run -d --restart=always \
     --hostname gitlab.mydomain.com \
     --expose 80 \
     --volume /srv/gitlab/config:/etc/gitlab \
     --volume /srv/gitlab/data:/var/opt/gitlab \
     --volume /var/log/gitlab:/var/log/gitlab \
     --label traefik.frontend.rule=Host:gitlab.mydomain.com \
     --name gitlab gitlab/gitlab-ce:latest

转到https://gitlab.mydomain.com/我得到一个带有LetsEncrypt生成证书的安全站点,但该站点未加载:

内部服务器错误

当我重新加载页面时,我看到docker logs gitlab -f:

==> /var/log/gitlab/sshd/current <==
2017-02-12_16:51:31.00446 Bad protocol version identification 'GET / HTTP/1.1' from 172.17.0.8 port 41138
2017-02-12_16:51:31.26238 Bad protocol version identification 'GET /favicon.ico HTTP/1.1' from 172.17.0.8 port 41140

/error/i在日志中搜索我看到可能有问题的几件事(zruby/gems/2.3.0/gems/redis-3.2.2z中报告了很多错误)但没有"吸烟枪"AFAICT.

为了docker restart gitlab弥补疯狂,大约每十个左右(随机)时间,我运行的网站就完美了.我一直想把它留下来,但其中却是疯狂......

我怎样才能让它可靠地出现？或者我如何更完整地调试它？

Answer 1

这个答案可能对你来说太晚了,但我遇到了同样的问题,并且能够解决它.

重要的线索是日志错误是sshd守护进程!

默认情况下,Traefik将选择容器暴露的第一个端口(通过Dockerfile,而不是您手动公开的端口!).在Gitlab容器的情况下,这是ssh端口22.

所以Traefik会将Web请求指向Gitlab的SSH守护进程.

要解决此问题,您需要使用标签明确设置Traefik的端口:

labels:
    ...
    - traefik.port=80

Answer 2

我使用了Sameersbn 的 docker-compose并在同一目录中添加了以下 docker-compose.override.yml 。

version: "2"

services:
    gitlab:
      labels:
        - "traefik.frontend.rule=Host:git.schulz.codes"
        - "traefik.port=80"
        - "traefik.enable=true"
        - "traefik.frontend.entryPoints=http,https"

这可以通过以下 traefik docker-compose 保持安静地工作

version: "2"

services:
  proxy:
    restart: always
    image: traefik
    container_name: traefik
    command: --web --docker --docker.domain=docker.localhost --logLevel=DEBUG
    ports:
      - "8080:8080"
      - "80:80"
      - "443:443"
    volumes:
      - ./traefik.toml:/etc/traefik/traefik.toml
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data:/etc/traefik/acme:rw

和这个 traefik.toml

[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
defaultEntryPoints = ["http", "https"]
[acme]
email = "yourmail@domain.com"
storageFile = "/etc/traefik/acme/acme.json"
entryPoint = "https"
OnHostRule = true
[[acme.domains]]
  main = "domain.com"
  sans = ["gitlab.domain.com"]
[web]
address = ":8080"
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "docker.localhost"
watch = true
exposedbydefault = true