docker-compose查看服务状态(Docker+DockerCompose封装web应用的方法步骤)
类别:服务器 浏览量:2032
时间:2021-09-29 01:04:22 docker-compose查看服务状态
Docker+DockerCompose封装web应用的方法步骤目录
- 技术栈
- 后端构建 api
- 前端构建 web
- 网关构建 gateway
- Nginx 配置
- Dockerfile
- Lua 实现基于企业微信的网关认证
- 使用 DockerCompose 进行容器编排
这篇文章会介绍如何将后端、前端和网关通通使用 Docker 容器进行运行,并最终使用 DockerCompose 进行容器编排。
技术栈前端
- React
- Ant Design
后端
- Go
- Iris
网关
- Nginx
- OpenResty
- Lua
- 企业微信
这里虽然我们写了 EXPOSE 4182,这个只用在测试的时候,生产环境实际上我们不会将后端接口端口进行暴露,
而是通过容器间的网络进行互相访问,以及最终会使用 Nginx 进行转发。
FROM golang:1.15.5 LABEL maintainer="K8sCat <k8scat@gmail.com>" EXPOSE 4182 ENV GOPROXY=https://goproxy.cn,direct \ GO111MODULE=on WORKDIR /go/src/github.com/k8scat/containerized-app/api COPY . . RUN go mod download && \ go build -o api main.go && \ chmod +x api ENTRYPOINT [ "./api" ]
这里值得一提的是,因为前端肯定会去调用后端接口,而且这个接口地址是根据部署而改变,
所以这里我们使用了 ARG 指令进行设置后端的接口地址,这样我们只需要在构建镜像的时候传入 --build-arg REACT_APP_BASE_URL=https://example.com/api
就可以调整后端接口地址了,而不是去改动代码。
还有一点,有朋友肯定会发现这里同时使用到了 Entrypoint 和 CMD,这是为了可以在运行的时候调整前端的端口,但实际上我们这里没必要去调整,因为这里最终也是用 Nginx 进行转发。
FROM node:lts LABEL maintainer="K8sCat <k8scat@gmail.com>" WORKDIR /web COPY . . ARG REACT_APP_BASE_URL RUN npm config set registry https://registry.npm.taobao.org && \ npm install && \ npm run build && \ npm install -g serve ENTRYPOINT [ "serve", "-s", "build" ] CMD [ "-l", "3214" ]
Nginx 配置
这里我们就分别设置了后端和前端的上游,然后设置 location 规则进行转发。
这里有几个点可以说一下:
- 通过 set_by_lua 获取容器的环境变量,最终在运行的时候通过设置 environment 设置这些环境变量,更加灵活
- server_name 使用到了 $hostname,运行时需要设置容器的 hostname
- ssl_certificate 和 ssl_certificate_key 不能使用变量设置
- 加载 gateway.lua 脚本实现企业微信的网关认证
upstream web { server ca-web:3214; } upstream api { server ca-api:4182; } server { set_by_lua $corp_id 'return os.getenv("CORP_ID")'; set_by_lua $agent_id 'return os.getenv("AGENT_ID")'; set_by_lua $secret 'return os.getenv("SECRET")'; set_by_lua $callback_host 'return os.getenv("CALLBACK_HOST")'; set_by_lua $callback_schema 'return os.getenv("CALLBACK_SCHEMA")'; set_by_lua $callback_uri 'return os.getenv("CALLBACK_URI")'; set_by_lua $logout_uri 'return os.getenv("LOGOUT_URI")'; set_by_lua $token_expires 'return os.getenv("TOKEN_EXPIRES")'; set_by_lua $use_secure_cookie 'return os.getenv("USE_SECURE_COOKIE")'; listen 443 ssl http2; server_name $hostname; resolver 8.8.8.8; ssl_certificate /certs/cert.crt; ssl_certificate_key /certs/cert.key; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers AESGCM:HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; lua_ssl_verify_depth 2; lua_ssl_trusted_certificate /etc/pki/tls/certs/ca-bundle.crt; if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") { set $year $1; set $month $2; set $day $3; } access_log logs/access_$year$month$day.log main; error_log logs/error.log; access_by_lua_file "/usr/local/openresty/nginx/conf/gateway.lua"; location ^~ /gateway { root html; index index.html index.htm; } location ^~ /api { proxy_pass http://api; proxy_read_timeout 3600; proxy_http_version 1.1; proxy_set_header X_FORWARDED_PROTO https; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header Connection ""; } location ^~ / { proxy_pass http://web; proxy_read_timeout 3600; proxy_http_version 1.1; proxy_set_header X_FORWARDED_PROTO https; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header Connection ""; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } server { listen 80; server_name $hostname; location / { rewrite ^/(.*) https://$server_name/$1 redirect; } }
Dockerfile
FROM openresty/openresty:1.19.3.1-centos LABEL maintainer="K8sCat <k8scat@gmail.com>" COPY gateway.conf /etc/nginx/conf.d/gateway.conf COPY gateway.lua /usr/local/openresty/nginx/conf/gateway.lua COPY nginx.conf /usr/local/openresty/nginx/conf/nginx.conf # Install lua-resty-http RUN /usr/local/openresty/luajit/bin/luarocks install lua-resty-http
Lua 实现基于企业微信的网关认证
这里面的一些配置参数都是通过获取 Nginx 设置的变量。
local json = require("cjson") local http = require("resty.http") local uri = ngx.var.uri local uri_args = ngx.req.get_uri_args() local scheme = ngx.var.scheme local corp_id = ngx.var.corp_id local agent_id = ngx.var.agent_id local secret = ngx.var.secret local callback_scheme = ngx.var.callback_scheme or scheme local callback_host = ngx.var.callback_host local callback_uri = ngx.var.callback_uri local use_secure_cookie = ngx.var.use_secure_cookie == "true" or false local callback_url = callback_scheme .. "://" .. callback_host .. callback_uri local redirect_url = callback_scheme .. "://" .. callback_host .. ngx.var.request_uri local logout_uri = ngx.var.logout_uri or "/logout" local token_expires = ngx.var.token_expires or "7200" token_expires = tonumber(token_expires) local function request_access_token(code) local request = http.new() request:set_timeout(7000) local res, err = request:request_uri("https://qyapi.weixin.qq.com/cgi-bin/gettoken", { method = "GET", query = { corpid = corp_id, corpsecret = secret, }, ssl_verify = true, }) if not res then return nil, (err or "access token request failed: " .. (err or "unknown reason")) end if res.status ~= 200 then return nil, "received " .. res.status .. " from https://qyapi.weixin.qq.com/cgi-bin/gettoken: " .. res.body end local data = json.decode(res.body) if data["errcode"] ~= 0 then return nil, data["errmsg"] else return data["access_token"] end end local function request_user(access_token, code) local request = http.new() request:set_timeout(7000) local res, err = request:request_uri("https://qyapi.weixin.qq.com/cgi-bin/user/getuserinfo", { method = "GET", query = { access_token = access_token, code = code, }, ssl_verify = true, }) if not res then return nil, "get profile request failed: " .. (err or "unknown reason") end if res.status ~= 200 then return nil, "received " .. res.status .. " from https://qyapi.weixin.qq.com/cgi-bin/user/getuserinfo" end local userinfo = json.decode(res.body) if userinfo["errcode"] == 0 then if userinfo["UserId"] then res, err = request:request_uri("https://qyapi.weixin.qq.com/cgi-bin/user/get", { method = "GET", query = { access_token = access_token, userid = userinfo["UserId"], }, ssl_verify = true, }) if not res then return nil, "get user request failed: " .. (err or "unknown reason") end if res.status ~= 200 then return nil, "received " .. res.status .. " from https://qyapi.weixin.qq.com/cgi-bin/user/get" end local user = json.decode(res.body) if user["errcode"] == 0 then return user else return nil, user["errmsg"] end else return nil, "UserId not exists" end else return nil, userinfo["errmsg"] end end local function is_authorized() local headers = ngx.req.get_headers() local expires = tonumber(ngx.var.cookie_OauthExpires) or 0 local user_id = ngx.unescape_uri(ngx.var.cookie_OauthUserID or "") local token = ngx.var.cookie_OauthAccessToken or "" if expires == 0 and headers["OauthExpires"] then expires = tonumber(headers["OauthExpires"]) end if user_id:len() == 0 and headers["OauthUserID"] then user_id = headers["OauthUserID"] end if token:len() == 0 and headers["OauthAccessToken"] then token = headers["OauthAccessToken"] end local expect_token = callback_host .. user_id .. expires if token == expect_token and expires then if expires > ngx.time() then return true else return false end else return false end end local function redirect_to_auth() return ngx.redirect("https://open.work.weixin.qq.com/wwopen/sso/qrConnect?" .. ngx.encode_args({ appid = corp_id, agentid = agent_id, redirect_uri = callback_url, state = redirect_url })) end local function authorize() if uri ~= callback_uri then return redirect_to_auth() end local code = uri_args["code"] if not code then ngx.log(ngx.ERR, "not received code from https://open.work.weixin.qq.com/wwopen/sso/qrConnect") return ngx.exit(ngx.HTTP_FORBIDDEN) end local access_token, request_access_token_err = request_access_token(code) if not access_token then ngx.log(ngx.ERR, "got error during access token request: " .. request_access_token_err) return ngx.exit(ngx.HTTP_FORBIDDEN) end local user, request_user_err = request_user(access_token, code) if not user then ngx.log(ngx.ERR, "got error during profile request: " .. request_user_err) return ngx.exit(ngx.HTTP_FORBIDDEN) end ngx.log(ngx.ERR, "user id: " .. user["userid"]) local expires = ngx.time() + token_expires local cookie_tail = "; version=1; path=/; Max-Age=" .. expires if use_secure_cookie then cookie_tail = cookie_tail .. "; secure" end local user_id = user["userid"] local user_token = callback_host .. user_id .. expires ngx.header["Set-Cookie"] = { "OauthUserID=" .. ngx.escape_uri(user_id) .. cookie_tail, "OauthAccessToken=" .. ngx.escape_uri(user_token) .. cookie_tail, "OauthExpires=" .. expires .. cookie_tail, } return ngx.redirect(uri_args["state"]) end local function handle_logout() if uri == logout_uri then ngx.header["Set-Cookie"] = "OauthAccessToken==deleted; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT" --return ngx.redirect("/") end end handle_logout() if (not is_authorized()) then authorize() end
这里需要讲几个点:
- 设置前端的 args 可以在前端构建时传入后端接口地址
- 设置网关的 hostname 可以设置网关容器的 hostname
- 设置网关的 environment 可以传入相关配置
- 最终运行时只有网关层进行暴露端口
version: "3.8" services: api: build: ./api image: ca-api:latest container_name: ca-api web: build: context: ./web args: REACT_APP_BASE_URL: https://example.com/api image: ca-web:latest container_name: ca-web gateway: build: ./gateway image: ca-gateway:latest hostname: example.com volumes: - ./gateway/certs/fullchain.pem:/certs/cert.crt - ./gateway/certs/privkey.pem:/certs/cert.key ports: - 80:80 - 443:443 environment: - CORP_ID= - AGENT_ID= - SECRET= - CALLBACK_HOST=example.com - CALLBACK_SCHEMA=https - CALLBACK_URI=/gateway/oauth_wechat - LOGOUT_URI=/gateway/oauth_logout - TOKEN_EXPIRES=7200 - USE_SECURE_COOKIE=true container_name: ca-gateway
开源代码
GitHub https://github.com/k8scat/containerized-app
Gitee https://gitee.com/k8scat/containerized-app
到此这篇关于Docker+DockerCompose封装web应用的文章就介绍到这了,更多相关Docker+DockerCompose封装web应用内容请搜索开心学习网以前的文章或继续浏览下面的相关文章希望大家以后多多支持开心学习网!
您可能感兴趣
- docker如何加volume(Dockerfile 中 VOLUME 与 docker -v 的区别说明)
- 2022-01-25 00:54:18
- docker 命令上传镜像到镜像仓库(Docker 制作镜像Dockerfile和commit操作)
- docker镜像如何打包(Docker打包镜像及修改配置的实现)
- dockerjenkins最新消息(新手必看docker安装jenkins详细教程)
- docker常用操作(docker常用命令汇总)
- docker容器重启配置没了(docker修改未启动容器的配置信息操作)
- windows docker 使用数据库教程(docker安装并持久化postgresql数据库的操作步骤)
- 用docker搭建redis集群(docker实现redis集群搭建的方法步骤)
- docker插件容器使用(Docker容器开jupyter不能访问到的解决方法)
- docker-compose部署实例(详解docker-compose速度太慢解决方式)
- docker搭建elasticsearch(docker安装ElasticSearch:7.8.0集群的详细教程)
- docker显示出错应用图标怎么处理(docker 命令报异常permission denied的解决方案)
- docker运行tomcat服务(使用 docker部署tomcat并接入skywalking的使用)
- docker和jenkins部署的区别(docker搭建jenkins服务的示例)
- 如何使用docker启动tomcat(简述Docker安装Tomcat镜像并部署web项目)
- 英语难学吗(初中英语难学吗)
- 如何追女孩子(如何追女孩子的技巧和方法)
- 是不是快乐全被你拿走了(而是你得到的)
- 世界上只有妈妈好(世界上只有妈妈好的歌词)
- 为什么现在社会越来越卷了(现在社会为什么发展那么快呢)
- 直播带货能赚到很多钱吗(直播带货能赚到很多钱吗现在)
热门推荐
- C#中Nullable<T>
- mysql整体架构设计(MySQL 整体架构介绍)
- dedecms标签调用大全(DedeCMS 5.7系统TAG标签伪静态设置)
- sqlserver触发器修改当前字段(利用SQL Server触发器实现表的历史修改痕迹记录)
- dedecms系统参数设置(织梦dedecms首页调用指定栏目内容的标签详解)
- python获取excelsheet名称(python查询文件夹下excel的sheet名代码实例)
- ASP.NET中使用CodeDomProvider调用js文件中的js方法
- SQL SERVER数据库状态
- vue父组件怎么用子组件的数据(Vue使用v-model封装el-pagination组件的全过程)
- html5页面强制刷新(移动端html5判断是否滚动到底部并且下拉加载)
排行榜
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9