Docker-Compose中Traefik反向代理下WordPress容器Bad Gateway问题

我并非服务器管理员，而是负责搭建开发服务器的Web程序员，对相关操作并不熟悉。我的操作可能不符合最佳实践，也可能与您的常规做法不同。Traefik通常有三种操作方式，我找到的答案中有三分之二与我的实现不兼容，且无法调整适配。此外，这并非我的核心工作内容。

环境配置 #

• Linode服务器上基于Ubuntu 20.04的单节点Docker环境
• 已配置包含Traefik、Traefik Hub、Portainer和WhoAmI的栈，基本可正常运行（Let's Encrypt的DNS验证暂未配置成功，但目前无需通配符证书）
• 创建了一个MariaDB容器，因主要使用WordPress，希望用单容器统一管理所有项目数据库，而非逐个环境配置
• 创建了名为maverick-net的外部网桥网络，所有栈均连接至此网络
• 部署了自托管GitHub Runner，监听项目dev分支变更，拉取最新代码、写入GitHub密钥到本地.env文件、执行composer install后运行docker-compose up -d（这是绑定挂载路径过长的原因）
• 为实现WordPress项目代码复用，各文件中使用了大量.env变量，后续可能迁移至Docker Secrets，但当前为开发服务器，暂不紧急

当前问题 #

无法成功运行WordPress站点，持续出现Bad Gateway错误。在Traefik容器内curl该URL时，同样返回Bad Gateway。已尝试多种方案数周仍未解决。此外，无论wp-cli容器与MariaDB是否在同一栈，或通过maverick-net网络连接，均无法连接数据库，推测对Docker网络的理解存在盲区。

相关配置文件 #

Traefik栈（注：后续计划将command条目拆分至静态和动态配置文件，当前暂未处理） #

version: "3.9"

secrets:
  linode_token:
    file: "../secrets/linode_token.secret"

services:

  traefik:
    container_name: traefik
    image: "traefik:latest"
    command:
      - --log.level=DEBUG
      - --log.filePath=./traefik.log
      - --accessLog=true
      - --accessLog.filePath=./access.log
      - --accessLog.bufferingSize=100
      - --accessLog.filters.statusCodes=400-499
      - --api
      - --api.dashboard=true
      - --api.insecure=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --providers.docker
      - --providers.docker.watch=true
      - --providers.docker.exposedbydefault=false
      - --certificatesresolvers.leresolver.acme.dnsChallenge=true
      - --certificatesresolvers.leresolver.acme.dnsChallenge.provider=linodev4
      - --certificatesresolvers.leresolver.acme.httpchallenge=true
      - --certificatesresolvers.leresolver.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.leresolver.acme.email=xxxxxxxxxxx@xxxxxxxxx.xxx
      - --certificatesresolvers.leresolver.acme.storage=./acme.json
      #- --certificatesresolvers.leresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      - --certificatesresolvers.leresolver.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
      - --experimental.hub=true
      - --hub.tls.insecure=true
      - --metrics.prometheus.addrouterslabels=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ~/certs-data/acme.json:/data/letsencrypt/acme.json
      - ./static.yml:/static.yml:ro
      - ./configs:/configs
      - ~/certs-data/:/data/letsencrypt/
    secrets:
      - "linode_token"
    environment:
      TZ: America/Chicago
      LINODE_TOKEN_FILE: "/run/secrets/linode_token"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=maverick-net"
      - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.entrypoints=web"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.routers.traefik.tls.certresolver=leresolver"
      - "traefik.http.routers.traefik.rule=Host(`XXXXX.XXXXXXXXXX.XXX`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=XXXX:$$apr1$$XXXXX$$XXXXXXXXXXXXXXX"
      - "traefik.http.routers.api.entrypoints=websecure"
    networks:
      - maverick-net

  hub-agent:
    image: ghcr.io/traefik/hub-agent-traefik:experimental
    pull_policy: always
    container_name: hub-agent
    restart: on-failure
    command:
      - run
      - --hub.token=XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX
      - --auth-server.advertise-url=http://hub-agent
      - --traefik.host=traefik
      - --traefik.tls.insecure=true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      - traefik
    networks:
      - maverick-net

  portainer:
    image: portainer/portainer-ce:latest
    command: -H unix:///var/run/docker.sock
    container_name: portainer
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    labels:
      # Frontend
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`XXXXX.XXXXXXXXXX.XXX`)"
      - "traefik.http.routers.frontend.entrypoints=websecure"
      - "traefik.http.services.frontend.loadbalancer.server.port=9000"
      - "traefik.http.routers.frontend.service=frontend"
      - "traefik.http.routers.frontend.tls.certresolver=leresolver"
    networks:
      - maverick-net

  whoami:
    image: "traefik/whoami"
    container_name: "whoami"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`XXXXX.XXXXXXXXXX.XXX`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=leresolver"
    networks:
      - maverick-net

volumes:
  portainer_data:
networks:
  maverick-net:
    external: true

MariaDB栈 #

version: "3"

networks:
  # enable connection with Traefik
  maverick-net:
    external: true

services:
  mariadb:
    container_name: mariadb
    image: mariadb:10.7
    restart: always
    volumes:
      - "/home/xxxxxxxxxx/docker/mariadb/data:/var/lib/mysql"
    expose:
      - "3306"
    env_file: .env
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PWD}
      MYSQL_USER: ${ADMIN_DB_USER}
      MYSQL_PASSWORD: ${ADMIN_DB_PWD}
    networks:
      - maverick-net

WordPress栈 #

version: '3.8'

networks:
  maverick-net:
    external: true
# volumes:
#   db_data:

services:

  # mariadb:
  #   container_name: ${WORDPRESS_DB_NAME}-db
  #   image: mariadb:10.7
  #   restart: always
  #   volumes:
  #     - "db_data:/var/lib/mysql"
  #   env_file: .env
  #   environment:
  #     MYSQL_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
  #     MYSQL_USER: ${ADMIN_DB_USER}
  #     MYSQL_PASSWORD: ${ADMIN_DB_PWD}

  wordpress:
    container_name: ${WORDPRESS_DB_NAME}-wp
    image: wordpress:6.0.2-fpm
    volumes:
      - type: bind
        source: ${PROJECT_ROOT}/${WORDPRESS_DB_NAME}/${PROJECT_NAME}/${PROJECT_NAME}/wp
        target: /var/www/html
    restart: always
    env_file: .env
    environment:
      WORDPRESS_DB_HOST: mariadb
      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
      WORDPRESS_DATABASE_USER: ${WORDPRESS_DB_USER}
      WORDPRESS_DATABASE_PASSWORD: ${WORDPRESS_DB_PASSWORD}
      WORDPRESS_DATABASE_NAME: ${WORDPRESS_DB_NAME}
    labels:
      # The labels are useful for Traefik only
      - "traefik.enable=true"
      - "traefik.docker.network=maverick-net"
      # Get the routes from https
      - "traefik.http.routers.${WORDPRESS_DB_NAME}.rule=Host(`${DEV_URL}`)"
      - "traefik.http.routers.${WORDPRESS_DB_NAME}.entrypoints=websecure"
      - "traefik.http.routers.${WORDPRESS_DB_NAME}.tls.certresolver=leresolver"
    networks:
      - maverick-net

  wordpress-cli:
    container_name: ${WORDPRESS_DB_NAME}-cli
    image: wordpress:cli
    volumes:
      - type: bind
        source: ${PROJECT_ROOT}/${WORDPRESS_DB_NAME}/${PROJECT_NAME}/${PROJECT_NAME}/wp
        target: /var/www/html
    env_file: .env
    environment:
      WORDPRESS_DB_HOST: mariadb
      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
      WORDPRESS_DATABASE_USER: ${WORDPRESS_DB_USER}
      WORDPRESS_DATABASE_PASSWORD: ${WORDPRESS_DB_PASSWORD}
      WORDPRESS_DATABASE_NAME: ${WORDPRESS_DB_NAME}
    networks:
      - maverick-net
    depends_on:
      - wordpress

内容的提问来源于stack exchange，提问作者Sean P