Traefik代理Docker中NiFi UI路由异常排查求助

我正在对Zookeeper、NiFi、NiFi Registry三个服务做容器化部署，对应的docker-compose.yml配置如下：

version: "3.7"
services:
    # configuration manager for NiFi
    zookeeper:
        hostname: myzookeeper
        # container_name: zookeeper_container_persistent
        image: zookeeper:latest  
        restart: on-failure
        environment:
            - ALLOW_ANONYMOUS_LOGIN=yes
        networks:
            - apache-nifi-internal
        deploy:
            restart_policy:
                condition: any
                delay: 5s
                max_attempts: 3
                window: 120s
# version control for nifi flows
    registry:
        user: root
        hostname: myregistry
        # container_name: registry_container_persistent
        image: apache/nifi-registry:latest 
        restart: on-failure
        environment:
            - LOG_LEVEL=INFO
            - NIFI_REGISTRY_DB_DIR=/opt/nifi-registry/nifi-registry-current/database
            - NIFI_REGISTRY_FLOW_PROVIDER=file
            - NIFI_REGISTRY_FLOW_STORAGE_DIR=/opt/nifi-registry/nifi-registry-current/flow_storage
        volumes:
            - nifi_registry_database:/opt/nifi-registry/nifi-registry-current/database
            - nifi_registry_flow_storage:/opt/nifi-registry/nifi-registry-current/flow_storage
        networks:
            - apache-nifi-internal
            - traefik_webgateway
        deploy:
            labels:
                # traefik
                - traefik.enable=true
                # service
                - traefik.http.services.nifi-registry.loadbalancer.server.port=18080
                # middlewares
                - traefik.http.middlewares.nifi-registry-prefix.stripprefix.prefixes=/nifi-registry
                - traefik.http.middlewares.nifi-registry-headers.headers.customrequestheaders.X-Forwarded-Proto=https
                # - traefik.http.middlewares.nifi-registry-redirect.redirectscheme.scheme=https
                # Routers
                - traefik.http.routers.nifi-registry.middlewares=nifi-registry-prefix,nifi-registry-headers
                - traefik.http.routers.nifi-registry.service=nifi-registry
                - traefik.http.routers.nifi-registry.entrypoints=$TRAEFIK_HTTPS_ENTRYPOINT
                - traefik.http.routers.nifi-registry.tls=true
                - traefik.http.routers.nifi-registry.rule=Host(`$DOCKER_HOST_URL`) && PathPrefix(`/nifi-registry`)
            restart_policy:
                condition: any
                delay: 120s
                max_attempts: 3
                window: 60s
    nifi:
        user: root
        hostname: mynifi
        # container_name: nifi_container_persistent
        image: apache/nifi:latest
        restart: on-failure
        environment:
            - NIFI_WEB_HTTP_PORT=8443
            - NIFI_WEB_PROXY_CONTEXT_PATH=/
            # - NIFI_CLUSTER_IS_NODE=true
            # - SINGLE_USER_CREDENTIALS_USERNAME=admin
            # - SINGLE_USER_CREDENTIALS_PASSWORD=ctsBtRBKHRAx69EqUghvvgEvjnaLjFEB
            # - NIFI_CLUSTER_NODE_PROTOCOL_PORT=8082
            # - NIFI_ZK_CONNECT_STRING=myzookeeper:2181
            # - NIFI_ELECTION_MAX_WAIT=30 sec
            # - NIFI_SENSITIVE_PROPS_KEY='12345678901234567890A'
            # - DOCKER_HEALTHCHECK_TEST=curl $DOCKER_HOST_URL/nifi/
        # healthcheck:
        #     test: "${DOCKER_HEALTHCHECK_TEST:-curl $DOCKER_HOST_URL/nifi/}"
        #     interval: "60s"
        #     timeout: "3s"
        #     start_period: "5s"
        #     retries: 5
        volumes:
            - nifi_database_repository:/opt/nifi/nifi-current/database_repository
            - nifi_flowfile_repository:/opt/nifi/nifi-current/flowfile_repository
            - nifi_content_repository:/opt/nifi/nifi-current/content_repository
            - nifi_provenance_repository:/opt/nifi/nifi-current/provenance_repository
            - nifi_state:/opt/nifi/nifi-current/state
            - nifi_logs:/opt/nifi/nifi-current/logs
            - nifi_conf:/opt/nifi/nifi-current/conf
        networks:
            - apache-nifi-internal
            - traefik_webgateway
        deploy:
            labels:
                # traefik
                - traefik.enable=true
                # service
                - traefik.http.services.nifi-flow.loadbalancer.server.port=8443
                # middlewares
                - traefik.http.middlewares.nifi-prefix.stripprefix.prefixes=/nifi
                - traefik.http.middlewares.nifi-headers.headers.customrequestheaders.X-Forwarded-Proto=https
                # - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
                # Routers
                - traefik.http.routers.nifi-flow.middlewares=nifi-prefix,nifi-headers
                - traefik.http.routers.nifi-flow.service=nifi-flow
                - traefik.http.routers.nifi-flow.entrypoints=$TRAEFIK_HTTPS_ENTRYPOINT
                - traefik.http.routers.nifi-flow.tls=true
                - traefik.http.routers.nifi-flow.rule=Host(`$DOCKER_HOST_URL`) && PathPrefix(`/nifi`)
            restart_policy:
                condition: any
                delay: 120s
                max_attempts: 3
                window: 60s
            
networks:   
  apache-nifi-internal:
  traefik_webgateway:
    external: true
            
volumes:    
  nifi_conf: {external: true}
  nifi_database_repository: {external: true}
  nifi_flowfile_repository: {external: true}
  nifi_content_repository: {external: true}
  nifi_provenance_repository: {external: true}
  nifi_state: {external: true}
  nifi_logs: {external: true}
  nifi_registry_database: {external: true}
  nifi_registry_flow_storage: {external: true}
  # nifi_database_repository:
  #   external: true

现在遇到的问题是：通过https://domain_name/nifi/访问NiFi UI时出现异常页面；访问https://domain_name/nifi/nifi/时报错。需要实现通过https://domain_name/nifi/正常访问NiFi UI，求排查思路或解决方案。

核心问题是NiFi的代理上下文路径配置和Traefik的路由规则不匹配：

1. NiFi容器里设置了NIFI_WEB_PROXY_CONTEXT_PATH=/（根路径），但Traefik配置了PathPrefix(/nifi)并通过stripprefix中间件去掉了/nifi前缀，导致请求到达NiFi时是根路径/，但NiFi默认的UI入口路径是/nifi，所以返回异常。
2. 当访问https://domain_name/nifi/nifi/时，Traefik去掉/nifi前缀后转发到NiFi的/nifi路径，但NiFi的代理上下文路径设为/，会导致页面内的静态资源（JS、CSS等）的路径生成错误，进而引发报错。

调整NiFi和Traefik的配置，让两者的上下文路径匹配，以下是两种可行方案：

方案一：修改NiFi的代理上下文路径匹配Traefik前缀 #

1. 更新NiFi容器的环境变量：
   将NIFI_WEB_PROXY_CONTEXT_PATH=/改为NIFI_WEB_PROXY_CONTEXT_PATH=/nifi
   注意：当前NiFi的NIFI_WEB_HTTP_PORT=8443，NiFi默认HTTPS端口是8443，HTTP是8080，如果容器内启用的是HTTP服务，需要把端口改成8080，否则要确保NiFi配置了HTTPS证书。
2. 保留Traefik现有配置不变：
   Traefik的stripprefix中间件会去掉/nifi前缀，转发到NiFi的/nifi路径，正好匹配NiFi的UI入口。

修改后的NiFi环境变量片段：

environment:
    - NIFI_WEB_HTTP_PORT=8443
    - NIFI_WEB_PROXY_CONTEXT_PATH=/nifi
    # 其他注释或配置按需保留

方案二：修改Traefik路由规则，适配NiFi默认路径 #

1. 保持NiFi的NIFI_WEB_PROXY_CONTEXT_PATH=/不变
2. 更新Traefik的标签配置：
   • 移除stripprefix中间件
   • 添加路径重写规则，确保请求/nifi/**被转发到NiFi的/nifi/**路径
   • 调整中间件引用，只保留头部处理和路径重写

修改后的Traefik配置片段：

deploy:
    labels:
        - traefik.enable=true
        - traefik.http.services.nifi-flow.loadbalancer.server.port=8443
        # 保留头部处理中间件
        - traefik.http.middlewares.nifi-headers.headers.customrequestheaders.X-Forwarded-Proto=https
        # 添加路径重写中间件
        - traefik.http.middlewares.nifi-rewrite.replacepathregex.regex=^/nifi/(.*)
        - traefik.http.middlewares.nifi-rewrite.replacepathregex.replacement=/nifi/$1
        # 路由规则引用头部和重写中间件
        - traefik.http.routers.nifi-flow.middlewares=nifi-headers,nifi-rewrite
        - traefik.http.routers.nifi-flow.service=nifi-flow
        - traefik.http.routers.nifi-flow.entrypoints=$TRAEFIK_HTTPS_ENTRYPOINT
        - traefik.http.routers.nifi-flow.tls=true
        - traefik.http.routers.nifi-flow.rule=Host(`$DOCKER_HOST_URL`) && PathPrefix(`/nifi`)

• 查看NiFi容器日志：执行docker logs <nifi容器名>，检查是否有上下文路径或路由相关的错误信息
• 直接测试NiFi容器：在同网络的容器或主机上执行curl http://mynifi:8443/nifi，确认NiFi UI入口是否正常响应
• 检查Traefik日志：查看Traefik的访问日志，确认请求是否正确转发到NiFi，以及转发后的路径是否符合预期

内容的提问来源于stack exchange，提问作者DataWrangler