如何通过Docker Compose让Weaviate以HTTPS方式运行？

之前在Docker上成功运行HTTP版本的Weaviate，应用开发完成后需加固技术栈，第一步将Weaviate切换为HTTPS运行，后续再添加API密钥。按官方文档配置后服务虽能启动，但HTTPS请求无响应，HTTP请求仍正常工作。

测试结果 #

HTTPS请求测试 #

> curl -v -k https://localhost:8080/v1/schema
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:8080 
* Closing connection 0
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:8080 

HTTP请求测试 #

> curl -v -k http://localhost:8080/v1/schema 
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /v1/schema HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.88.1
> Accept: */*
> 
< HTTP/1.1 200 OK
< Content-Type: application/json
< Vary: Origin
< Date: Tue, 12 Sep 2023 19:57:01 GMT
< Content-Length: 15
< 
{"classes":[]}
* Connection #0 to host localhost left intact

当前docker-compose.yml配置 #

---
version: '3.4'
services:
  weaviate:
    command:
    - --host
    - 0.0.0.0
    - --port
    - '8080'
    - --scheme
    - https
    - --tls-certificate
    - /etc/ssl/certs/dev-certificate.pem
    - --tls-key
    - /etc/ssl/certs/dev-private-key.pem
    image: semitechnologies/weaviate:1.21.2
    ports:
    - 8080:8080
    volumes:
    - weaviate_data:/var/lib/weaviate
    - /etc/ssl/certs:/etc/ssl/certs
    restart: on-failure:0
    environment:
      AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: 'true'
      TRANSFORMERS_INFERENCE_API: 'http://t2v-transformers:8080'
      QUERY_DEFAULTS_LIMIT: 25
      PERSISTENCE_DATA_PATH: '/var/lib/weaviate'
      DEFAULT_VECTORIZER_MODULE: 'text2vec-transformers'
      ENABLE_MODULES: 'text2vec-transformers'
      CLUSTER_HOSTNAME: 'node1'
  t2v-transformers:
    image: semitechnologies/transformers-inference:sentence-transformers-multi-qa-MiniLM-L6-cos-v1
    environment:
      ENABLE_CUDA: '0'
volumes:
  weaviate_data:
...

排查与解决步骤 #

• 证书有效性验证

  1. 确认容器内证书文件可访问：执行docker exec -it <weaviate-container-id> ls -l /etc/ssl/certs/，检查dev-certificate.pem和dev-private-key.pem是否存在，权限是否为可读（建议设置为644）。
  2. 验证证书与私钥匹配：在容器内分别执行以下命令，两次输出的MD5值必须一致：

     openssl x509 -noout -modulus -in /etc/ssl/certs/dev-certificate.pem | openssl md5
     openssl rsa -noout -modulus -in /etc/ssl/certs/dev-private-key.pem | openssl md5
     

  3. 检查证书格式：确保证书文件以-----BEGIN CERTIFICATE-----开头，私钥文件以-----BEGIN PRIVATE KEY-----或-----BEGIN RSA PRIVATE KEY-----开头，避免格式错误。

• 端口配置调整
  当前HTTPS与HTTP复用8080端口可能导致协议冲突，建议为HTTPS分配独立端口：
  修改docker-compose.yml中Weaviate的端口映射和命令参数：

  services:
    weaviate:
      command:
        # 可选：将容器内端口改为443
        - --port
        - '443'
      ports:
        # 主机443端口映射到容器内的HTTPS端口（8080或443）
        - 443:443
  

  重启服务后，用curl -v -k https://localhost:443/v1/schema测试。

• 启动日志排查
  查看Weaviate容器启动日志，定位TLS相关报错：

  docker logs <weaviate-container-id>
  

  重点搜索TLS、certificate、private key等关键词，确认是否存在证书加载失败、权限不足等问题。

• 环境变量冲突检查
  确认没有环境变量覆盖命令行的--scheme配置，比如是否设置了SCHEME=http这类环境变量，Weaviate优先使用命令行参数，但需避免配置冲突。

内容的提问来源于stack exchange，提问作者J.D. Ray