如何通过Docker Compose为Payara Micro启用SSL

我正尝试为Payara Micro实例启用安全配置，通过Docker Compose运行标准Payara Micro镜像，已成功部署war包，当前Docker Compose配置如下：

version: '2.2'
services:
  payara_micro_service:
    restart: always
    image: "payara/micro:5.2022.2-jdk11"
    ports:
      - "8080:8080"
    volumes:
      - ./deployments:/opt/payara/deployments
      - ./resources:/resources

根据Payara官方文档，激活Payara Micro的SSL可通过系统属性或命令行参数（payaramicro.sslPort或--sslport）。我尝试通过注入环境变量来设置：

environment:
  payaramicro.sslPort: 8181

但并未生效，实例配置信息显示HTTPS端口为空：

{
    "Instance Configuration": {
        "Host": "adba96fca46a",
        "Http Port(s)": "8080",
        "Https Port(s)": "",
        "Instance Name": "Pleasant-Paddlefish",
        "Instance Group": "MicroShoal",
        "Hazelcast Member UUID": "435b3b12-9c4f-4f4c-8303-abe226125e4c",
        "Deployed": [
            {
                "Name": "my-service",
                "Type": "war",
                "Context Root": "/my-service"
            }
        ]
    }
}

请问如何通过Docker Compose正确配置Payara Micro的SSL？

Payara Micro的系统属性无法直接通过环境变量注入，需修改容器启动命令，将SSL相关参数传递给Payara Micro启动程序：

方法1：使用命令行参数--sslport #

在Docker Compose中添加command字段，直接指定SSL端口，同时映射对应端口到宿主机：

version: '2.2'
services:
  payara_micro_service:
    restart: always
    image: "payara/micro:5.2022.2-jdk11"
    ports:
      - "8080:8080"
      - "8181:8181"  # 映射SSL端口到宿主机
    volumes:
      - ./deployments:/opt/payara/deployments
      - ./resources:/resources
    command: --sslport 8181 --deploy /opt/payara/deployments

方法2：使用JVM系统属性-Dpayaramicro.sslPort #

通过command字段传递JVM系统属性来指定SSL端口：

version: '2.2'
services:
  payara_micro_service:
    restart: always
    image: "payara/micro:5.2022.2-jdk11"
    ports:
      - "8080:8080"
      - "8181:8181"
    volumes:
      - ./deployments:/opt/payara/deployments
      - ./resources:/resources
    command: -Dpayaramicro.sslPort=8181 --deploy /opt/payara/deployments

补充：自定义SSL证书（可选） #

如果需要使用自定义SSL证书，可将证书文件挂载到容器内，再通过命令行参数指定证书路径：

command: --sslport 8181 --sslCert /resources/your-cert.pem --sslKey /resources/your-key.pem --deploy /opt/payara/deployments

确保本地./resources目录下存在对应的证书文件，容器内路径与挂载路径一致即可。

内容的提问来源于stack exchange，提问作者B. Bri