PERN项目使用Traefik配置HTTPS出现502 Bad Gateway问题咨询

核心问题点 #

当前配置存在多处错误，直接导致Traefik无法正常转发流量到上游服务：

• Traefik 未开启Docker provider，无法读取服务上配置的Traefik标签
• Traefik 配置文件中硬编码了不存在的nginx服务作为上游，没有对应服务可以承接流量
• 前端app服务与后端api服务不在同一私有网络，Nginx无法代理/api请求到后端
• Nginx配置中/api代理地址写为localhost:3000，容器内localhost指向自身而非api服务
• 前后端服务配置的Traefik路由器名称重复，导致路由规则冲突
• Traefik v2版本不支持traefik.port写法，端口配置格式错误

排查步骤 #

1. 查看Traefik运行日志确认错误类型：

docker logs traefik

2. 验证app容器是否能连通api服务：

docker exec -it app ping api
# 如果返回无法解析域名，说明网络配置错误

3. 临时开启Traefik Dashboard查看路由/服务状态，确认配置是否生效（排查完成后关闭）

具体修复方案 #

1. 修改compose/traefik/traefik.yml #

删除硬编码的http.routers、http.services配置，新增Docker provider：

log:
  level: INFO

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: web-secure
  web-secure:
    address: ":443"

certificatesResolvers:
  letsencrypt:
    acme:
      email: "替换为你的实际邮箱"
      storage: /etc/traefik/acme/acme.json
      httpChallenge:
        entryPoint: web

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    filename: /etc/traefik/traefik.yml
    watch: true

2. 修改docker-compose.yml #

2.1 给Traefik服务添加docker.sock挂载

traefik:
  build:
    context: .
    dockerfile: ./compose/traefik/Dockerfile
  image: stats2win_traefik
  networks:
    - traefik-global-proxy
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock:ro # 新增这行
    - production_traefik:/etc/traefik/acme:z
  ports:
    - "80:80"
    - "443:443"
  # 可以删掉3000端口暴露，不需要对外暴露后端端口

2.2 修正前后端服务的标签与网络配置

api:
  container_name: api
  build:
    context: ./api
    dockerfile: Dockerfile
  volumes:
    - /api/node_modules
    - ./api:/api
  networks:
    - traefik-global-proxy
    - app
  restart: unless-stopped
  labels:
    - "traefik.enable=true"
    - "traefik.http.routers.api-secure.rule=Host(`替换为api的实际域名`)"
    - "traefik.http.routers.api-secure.entrypoints=web-secure"
    - "traefik.http.routers.api-secure.tls.certresolver=letsencrypt"
    - "traefik.http.services.api-secure.loadbalancer.server.port=3000" # 修正端口写法
---
app:
  container_name: app
  build:
    context: ./app
    dockerfile: Dockerfile 
  networks:
    - traefik-global-proxy
    - app # 新增app网络，和后端互通
  restart: unless-stopped
  labels:
    - "traefik.enable=true"
    - "traefik.http.routers.app-secure.rule=Host(`替换为前端的实际域名`)"
    - "traefik.http.routers.app-secure.entrypoints=web-secure"
    - "traefik.http.routers.app-secure.tls.certresolver=letsencrypt"
    - "traefik.http.services.app-secure.loadbalancer.server.port=80" # 修正端口写法

3. 修改app/compose/nginx/nginx.conf的代理地址 #

location /api {
  proxy_pass http://api:3000; # 将localhost改为api服务名
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Host $host;
  proxy_cache_bypass $http_upgrade;
}

4. 验证依赖并重启服务 #

1. 确认外部网络已创建：

docker network ls | grep traefik-global-proxy
# 不存在则执行：docker network create traefik-global-proxy

2. 重新构建启动服务：

docker-compose down -v
docker-compose up -d --build

等待1-2分钟让Let's Encrypt证书签发完成后再访问即可。

内容的提问来源于stack exchange，提问作者Codshark11