CentOS7单主机双域名多Docker web服务全站点SSL配置咨询

1. 前置准备 #

• 关闭宿主机之前直接映射到公网的Gitea 4100、Redmine 4200端口，仅保留容器端口对宿主机127.0.0.1开放，避免端口冲突和未加密访问风险
• 本次配置不会修改Seafile相关服务逻辑，原有cloud.myserver.com的访问不受影响
• 宿主机安装依赖包：

yum install -y epel-release nginx certbot python2-certbot-nginx
systemctl start nginx
systemctl enable nginx

• 若开启了firewalld防火墙，先放行必要端口：

firewall-cmd --add-port=80/tcp --add-port=443/tcp --add-port=4100/tcp --add-port=4200/tcp --permanent
firewall-cmd --reload

2. 申请services.myserver.com的SSL证书 #

执行certbot命令自动生成证书并配置基础HTTPS规则，按照提示输入邮箱、同意服务协议即可：

certbot --nginx -d services.myserver.com

certbot会自动配置证书续期定时任务，无需手动处理证书过期问题。

3. 配置Nginx反向代理规则 #

新建配置文件/etc/nginx/conf.d/services.conf，写入以下内容，对应修改容器本地映射端口即可：

# Gitea端口访问HTTPS配置
server {
    listen 4100 ssl http2;
    server_name services.myserver.com;
    ssl_certificate /etc/letsencrypt/live/services.myserver.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/services.myserver.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    access_log /var/log/nginx/gitea-port-access.log;
    error_log /var/log/nginx/gitea-port-error.log;

    location / {
        # 修改为Gitea容器映射到宿主机本地的端口
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Redmine端口访问HTTPS配置
server {
    listen 4200 ssl http2;
    server_name services.myserver.com;
    ssl_certificate /etc/letsencrypt/live/services.myserver.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/services.myserver.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    access_log /var/log/nginx/redmine-port-access.log;
    error_log /var/log/nginx/redmine-port-error.log;

    location / {
        # 修改为Redmine容器映射到宿主机本地的端口
        proxy_pass http://127.0.0.1:3001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 子路径访问统一HTTPS配置
server {
    listen 443 ssl http2;
    server_name services.myserver.com;
    ssl_certificate /etc/letsencrypt/live/services.myserver.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/services.myserver.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    access_log /var/log/nginx/services-subpath-access.log;
    error_log /var/log/nginx/services-subpath-error.log;

    # Gitea子路径配置
    location ^~ /gitea/ {
        proxy_pass http://127.0.0.1:3000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Redmine子路径配置
    location ^~ /redmine/ {
        proxy_pass http://127.0.0.1:3001/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# HTTP自动跳转HTTPS
server {
    listen 80;
    server_name services.myserver.com;
    return 301 https://$host$request_uri;
}

4. 服务适配调整 #

• Gitea：进入容器修改配置文件app.ini，找到[server]段修改ROOT_URL = https://services.myserver.com/gitea/，重启容器生效
• Redmine：启动容器时添加环境变量RAILS_RELATIVE_URL_ROOT="/redmine"，或进入容器修改对应配置后重启生效

5. 配置生效验证 #

执行以下命令检查Nginx配置语法，无报错则重载配置：

nginx -t
systemctl reload nginx

分别测试4种访问路径，均能正常访问且SSL证书有效即为配置成功：

• https://services.myserver.com:4100
• https://services.myserver.com:4200
• https://services.myserver.com/gitea
• https://services.myserver.com/redmine

内容的提问来源于stack exchange，提问作者GinTonic