dokcer容器中配置ssl 证书？

Question

我在服务器上运行了一个 whisper 语音转文字的镜像，https://hub.docker.com/r/onerahmet/openai-whisper-asr-webservice
docker-compose file 如下：

version: "3.7"
services:
  whisper-gpu:
    container_name:whisper-gpu
    build:
      context: ./
      dockerfile: Dockerfile.gpu
    image: whisper-service-gpu
    volumes:
      - ./:/home/app
    ports:
      - "9001:9000"
    environment:
      ASR_MODEL: "small"
      API_KEYS: "..."
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
volumes:
  myapp:

dockerfile

FROM python:3.9.9-slim

ENV POETRY_VERSION=1.2.0
ENV POETRY_VENV=/opt/poetry-venv

RUN export DEBIAN_FRONTEND=noninteractive \
    && apt-get -qq update \
    && apt-get -qq install --no-install-recommends \
    ffmpeg \
    && rm -rf /var/lib/apt/lists/*

RUN python3 -m venv $POETRY_VENV \
    && $POETRY_VENV/bin/pip install -U pip setuptools \
    && $POETRY_VENV/bin/pip install poetry==${POETRY_VERSION}

ENV PATH="${PATH}:${POETRY_VENV}/bin"

WORKDIR /app

COPY . /app
RUN poetry install

CMD [ "poetry", "run", "whisper_asr"]

目前服务运行正常，但是web访问的时候需要https， 我这个服务区是一个实体的服务器，所以需要手动配置证书， 目前我的域名已经使用了阿里云的免费单域名证书，请问下一步我该如何配置该证书？ 是把证书配置到宿主机上面还是配置在容器内？ 该如何去做？

Answer 1

问题解决了，贴一下 配置文件
docker-compose

version: "3.7"
services:
  whisper-gpu:
    container_name: whisper-gpu
    build:
      context: ./
      dockerfile: Dockerfile.gpu
    image: whisper-service-gpu
    volumes:
      - ./:/home/app
    ports:
      - "9001:9000"
    environment:
      ASR_MODEL: "small"
      API_KEYS: ""
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
  nginx:
    image: nginx:latest
    container_name: whisper-nginx
    ports:
      - 80:80
      - 443:443
      - 9005:9005
    volumes:
      - ./crt/nginx.conf:/etc/nginx/nginx.conf
      - ./crt/:/etc/nginx/certs
    restart: always
    depends_on:
      - whisper-gpu
volumes:
  myapp:

nginx

worker_processes 1;

events {
  worker_connections 1024;
}

http {
  server {
    listen 9005 ssl;
    server_name mydomain;
    ssl_certificate /etc/nginx/certs/mykey;
    ssl_certificate_key /etc/nginx/certs/mykey;
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout 5m;
 
    #默认加密套件
    ssl_ciphers HIGH:!aNULL:!MD5;
     
    #自定义设置使用的TLS协议的类型以及加密套件（以下为配置示例，请您自行评估是否需要配置）
    #TLS协议版本越高，HTTPS通信的安全性越高，但是相较于低版本TLS协议，高版本TLS协议对浏览器的兼容性较差。
    #ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    #ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    #表示优先使用服务端加密套件。默认开启
    ssl_prefer_server_ciphers on;
    location / {
      add_header 'Access-Control-Allow-Origin' 'mydomain' always;
      add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
      # 允许跨域请求携带的自定义头部
      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
      if ($request_method = OPTIONS) {
        add_header 'Access-Control-Allow-Origin' 'mydomain' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
      }
      proxy_pass http://whisper-gpu:9000;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }
  }
  server {
    listen 80;
    location / {
      proxy_pass http://whisper-gpu:9000;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }
  }
}

2023.7.19 补一个坑

如果多域名 可以采用这种形式 否则会报错

Answer 2

可以通过nginx来配置https访问，有两种实现方式：

第一种：在本机上安装nginx服务，配置相应ssl证书，然后转发到本地9001端口。

第二种：在docker-compose文件中，新加一段nginx的service，具体的nginx.conf内容和第一种基本相同，只是转发地址和端口就变成了 whisper-gpu:9000

以下nginx.conf 的参考配置：

server {
  listen 443;
  ssl on;
  ssl_certificate /etc/nginx/conf.d/cert.pem;
  ssl_certificate_key /etc/nginx/conf.d/key.pem;
  location / {
  proxy_pass http://whisper-gpu:9000;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $remote_addr;
 }
}

具体docker-compose的文件配置，就不写了，建议实现方式选择第二种，毕竟容器组中内部转发效率肯定更高，而且既然用容器了，那干脆都用容器来实现。

Answer 3

server {
    listen 443 ssl;
    server_name your-domain.com;

    ssl_certificate /etc/nginx/ssl/your-domain.com.crt;
    ssl_certificate_key /etc/nginx/ssl/your-domain.com.key;

    location / {
        proxy_pass http://localhost:9001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}