如何通过docker-compose部署带HTTPS证书的mongo-express服务

结论 #

官方提供的标准mongo-express镜像没有开放内置HTTPS的配置参数，无法直接通过环境变量开启HTTPS。以下提供两种可落地的实现方案，均可适配你的需求：

方案一：自定义启动逻辑（无额外服务依赖） #

该方案直接修改mongo-express容器的启动命令，启用HTTPS服务，不需要引入其他中间件：

1. 先将你的域名证书存放在项目目录的certs文件夹下，需包含两个文件：
   • 证书链文件：./certs/fullchain.pem
   • 私钥文件：./certs/privkey.pem
2. 修改docker-compose.yml中mongo-express服务的配置，完整配置如下：

version: "3.8"

services:
  db:
    container_name: mongo-dev
    hostname: mongo-dev
    image: mongo:4.2
    environment:
      - MONGO_INITDB_ROOT_USERNAME=admin
      - MONGO_INITDB_DATABASE=auth
      - MONGO_INITDB_ROOT_PASSWORD=pass
    networks:
      - mongo-compose-network
    ports:
      - '27017:27017'
    volumes:
      - ./data:/data/db

  mongo-express:
    container_name: mongo-express
    image: mongo-express:0.54.0
    depends_on:
      - db
    networks:
      - mongo-compose-network
    environment:
      - ME_CONFIG_MONGODB_SERVER=mongo-dev
      - ME_CONFIG_MONGODB_ADMINUSERNAME=admin
      - ME_CONFIG_MONGODB_ADMINPASSWORD=pass
      - ME_CONFIG_BASICAUTH_USERNAME=admin
      - ME_CONFIG_BASICAUTH_PASSWORD=tribes
    ports:
      - '8081:8443'
    volumes:
      - ./certs:/etc/certs
    command: >
      sh -c "node -e \"
      const https = require('https');
      const fs = require('fs');
      const app = require('/node_modules/mongo-express/app.js');
      const options = {
        key: fs.readFileSync('/etc/certs/privkey.pem'),
        cert: fs.readFileSync('/etc/certs/fullchain.pem')
      };
      https.createServer(options, app).listen(8443, '0.0.0.0');
      \""
    restart: on-failure

networks:
  mongo-compose-network:
    driver: bridge

配置完成后执行docker-compose up -d启动即可，直接访问https://my_host:8081即可使用mongo-express服务。

方案二：Nginx反向代理（生产环境推荐） #

该方案稳定性更高，后续扩展配置更灵活，不需要修改mongo-express本身的逻辑：

1. 准备证书文件，同样存放在./certs目录下
2. 新建Nginx配置文件./nginx/conf.d/mongo-express.conf，内容如下：

server {
    listen 8443 ssl;
    server_name my_host; # 替换为你的实际域名

    ssl_certificate /etc/certs/fullchain.pem;
    ssl_certificate_key /etc/certs/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://mongo-express:8081;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

3. 修改docker-compose.yml，新增Nginx服务配置，完整内容如下：

version: "3.8"

services:
  db:
    container_name: mongo-dev
    hostname: mongo-dev
    image: mongo:4.2
    environment:
      - MONGO_INITDB_ROOT_USERNAME=admin
      - MONGO_INITDB_DATABASE=auth
      - MONGO_INITDB_ROOT_PASSWORD=pass
    networks:
      - mongo-compose-network
    ports:
      - '27017:27017'
    volumes:
      - ./data:/data/db

  mongo-express:
    container_name: mongo-express
    image: mongo-express:0.54.0
    depends_on:
      - db
    networks:
      - mongo-compose-network
    environment:
      - ME_CONFIG_MONGODB_SERVER=mongo-dev
      - ME_CONFIG_MONGODB_ADMINUSERNAME=admin
      - ME_CONFIG_MONGODB_ADMINPASSWORD=pass
      - ME_CONFIG_BASICAUTH_USERNAME=admin
      - ME_CONFIG_BASICAUTH_PASSWORD=tribes
    restart: on-failure

  nginx:
    image: nginx:alpine
    container_name: mongo-express-nginx
    depends_on:
      - mongo-express
    networks:
      - mongo-compose-network
    ports:
      - "8081:8443"
    volumes:
      - ./certs:/etc/certs
      - ./nginx/conf.d:/etc/nginx/conf.d
    restart: on-failure

networks:
  mongo-compose-network:
    driver: bridge

启动后同样通过https://my_host:8081访问服务即可。

内容的提问来源于stack exchange，提问作者milanbalazs