运行Nominatim搭配Traefik时出现502 Bad Gateway错误

我有一台运行Traefik和Docker的服务器，部署的多个应用都能正常通过域名访问，但部署Nominatim镜像时遇到502 Bad Gateway错误，多次调整配置仍无法解决。以下是相关配置文件及排查方案：

现有配置文件 #

Traefik配置（traefik.yml） #

version: '3'

services:
  traefik:
    image: "traefik:v2.9"
    container_name: "traefik"
    network_mode: "host"
    command:
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      - "--providers.docker=true"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=XXXXXX"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--log.level=DEBUG"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "/root/shared:/root/shared"
    labels:
      - "traefik.http.services.dashboard.loadbalancer.server.port=80"
      - "traefik.http.middlewares.httpsonly.redirectscheme.scheme=https"
      - "traefik.http.middlewares.httpsonly.redirectscheme.permanent=true"
      - "traefik.http.routers.httpsonly.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.httpsonly.middlewares=httpsonly"
      - "traefik.http.routers.dashboard.rule=Host(`tra.XXXXXXXX`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=myresolver"
      - "traefik.http.routers.dashboard.service=dashboard@internal"
      - "traefik.http.routers.api.rule=Host(`tra.XXXXXXX`) && PathPrefix(`/api`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=myresolver"
      - "traefik.http.routers.dashboard.middlewares=traefik-auth"
      - "traefik.http.routers.api.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.usersfile=/root/shared/users"
      - "traefik.http.middlewares.traefik-auth.basicauth.removeheader=true"

Nominatim配置（nominatim.yml） #

version: '3'

services:
  nominatim:
    image: "mediagis/nominatim:4.1"
    container_name: "nominatim"
    shm_size: '1gb'
    environment:
      - "PBF_URL=https://download.geofabrik.de/europe-latest.osm.pbf"
      - "REPLICATION_URL=https://download.geofabrik.de/europe-updates/"
      - "IMPORT_WIKIPEDIA=false"
      - "NOMINATIM_PASSWORD=XXXXXXX"
      - "IMPORT_STYLE=address"
    volumes:
      - "/root/nominatim/data:/var/lib/postgresql/14/main"
    ports:
      - "1237:8080"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nominatim-r.rule=Host(`nominatim.XXXXXX`)"
      - "traefik.http.routers.nominatim-r.entrypoints=websecure"
      - "traefik.http.routers.nominatim-r.tls.certresolver=myresolver"
      - "traefik.http.routers.nominatim-r.service=nominatim-s@docker"
      - "traefik.http.services.nominatim-s.loadbalancer.server.port=1237"

正常运行的应用配置示例（geodude.yaml） #

version: '3'

services:
  geodude:
    image: "ghcr.io/mueslidotio/geodude:main"
    container_name: "geodude"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.geodude.rule=Host(`api.XXXXXX`)"
      - "traefik.http.routers.geodude.entrypoints=websecure"
      - "traefik.http.routers.geodude.tls.certresolver=myresolver"

当前Docker栈中所有应用均可通过域名访问，唯有Nominatim无法正常访问，返回502错误。

问题排查与解决步骤 #

1. 修正Traefik端口配置错误 #

Nominatim容器内部监听的是8080端口，你当前配置中指定的1237是宿主机的映射端口，Traefik需要直接访问容器内部端口。修改Nominatim的Traefik标签：

- "traefik.http.services.nominatim-s.loadbalancer.server.port=8080"

2. 解决网络模式冲突 #

Traefik使用network_mode: host，而Nominatim默认使用桥接网络，可能导致Traefik无法访问到Nominatim容器：

• 推荐创建自定义Docker网络，将Traefik和Nominatim都加入该网络：

  docker network create traefik-net
  

  然后修改Traefik配置，移除network_mode: host，添加网络配置：

  networks:
    - traefik-net
  

  同时在Nominatim配置中添加相同的网络配置：

  networks:
    - traefik-net
  

• 若坚持使用host模式，需确保Nominatim容器的8080端口未被宿主机其他服务占用，且Traefik能直接访问到该端口。

3. 确认容器初始化完成 #

Nominatim启动时需要导入欧洲区域的OSM数据，这个过程耗时极长（可能数小时）。在数据导入完成前，容器内的服务并未启动，此时访问会返回502。通过日志确认状态：

docker logs -f nominatim

等待日志显示服务启动完成（如出现Listening on port 8080）后再尝试访问。

4. 检查Traefik服务发现状态 #

• 访问Traefik仪表盘，查看服务列表中是否存在nominatim-s
• 查看Traefik日志，搜索是否有Nominatim相关的错误信息：

  docker logs -f traefik
  

内容的提问来源于stack exchange，提问作者garrym