docker部署jenkins/gitlab/nexus3/nginx配置端口转发与ssl

Docker 官方容器镜像仓库

https://hub.docker.com/search

部署 jenkins

docker run 命令

sudo mkdir -p /opt/jenkins_home
# Jenkins 容器默认使用用户 ID 1000 
sudo chown -R 1000:1000 /opt/jenkins_home
docker run -d --name jenkins --restart=always -p 8080:8080 -p 50000:50000 -v /opt/jenkins_home:/var/jenkins_home jenkins/jenkins:2.541.1-lts

部署gitlab

docker run 命令

docker run -d --name gitlab -p 180:80 -p 143:443 -p 122:22 --restart always -v /opt/gitlab/config:/etc/gitlab -v /opt/gitlab/logs:/var/log/gitlab -v /opt/gitlab/data:/var/opt/gitlab gitlab/gitlab-ce:18.8.1-ce.0

部署nexus3

docker run 命令

sudo mkdir -p  /opt/nexus3
sudo chown -R 200:200 /opt/nexus3
docker run -d --name nexus3 -p 8081:8081 --restart always -v /opt/nexus3:/nexus-data sonatype/nexus3:3.87.2

部署nginx

先把nginx需要的配置文件从nginx容器cp到本地

mkdir -p /opt/nginx/conf/
docker run -d --name nginx_tmp nginx:1.28.1-alpine-slim
# 注意 nginx/. 有个点 这样就只 cp nginx目录下的配置文件
docker cp nginx_tmp:/etc/nginx/. /opt/nginx/conf/
docker rm -f nginx_tmp

docker run 命令

docker run -d --name nginx  -p 80:80 -p 443:443 --restart always -v /opt/nginx/conf:/etc/nginx:ro -v /opt/nginx/logs:/var/log/nginx nginx:1.28.1-alpine-slim

jenkins为列 配置 80 端口

转发到对应的 容器 8080 端口

我用 cloudflare 进行测试 做域名解析

把下面的配置文件复制到 jenkins.conf

vim /opt/nginx/conf/conf.d/jenkins.conf

server {
    listen 80;
    #  jenkinss.relatedyuan.dpdns.org  这个是绑定的域名 需要解析到对应的服务器公网IP
    server_name jenkinss.relatedyuan.dpdns.org;

    client_max_body_size 4096m;
    access_log /var/log/nginx/jenkins_access.log;

    location / {
   		# 10.0.2.15:8080  IP是主机的内网IP 端口是容器暴露的 8080 端口
        proxy_pass http://10.0.2.15:8080;

        # 核心代理头
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket支持
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 超时设置
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        # 防止请求重复
        proxy_next_upstream off;
    }
}

重启nginx生效

docker restart nginx

因为不是 https 所有会提示不安全

jenkins为列 配置 443 端口

转发到对应的 容器 8080 端口
代理状态 开启 已代理

SSL 当前加密模式 : 完全

在 cloudflare 上配置 源服务器 创建证书

注意证书创建后 无法在查看 需要提前保存

mkdir -p /opt/nginx/conf/ssl/jenkinss.relatedyuan.dpdns.org
# 把上面的证书放在下面的两个文件里面
vim /opt/nginx/conf/ssl/jenkinss.relatedyuan.dpdns.org/fullchain.pem
vim /opt/nginx/conf/ssl/jenkinss.relatedyuan.dpdns.org/privkey.pem

把下面的配置文件复制到 jenkins.conf

vim /opt/nginx/conf/conf.d/jenkins.conf

server {
    # HTTPS 监听
    listen 443 ssl;
    server_name jenkinss.relatedyuan.dpdns.org;

    # ========== SSL 证书配置 ==========
    ssl_certificate /etc/nginx/ssl/jenkinss.relatedyuan.dpdns.org/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/jenkinss.relatedyuan.dpdns.org/privkey.pem;

    # ========== SSL 优化配置 ==========
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;

    # SSL 会话缓存
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;

    # 启用 OCSP Stapling（提升性能）
    ssl_stapling on;
    ssl_stapling_verify on;

    # ========== 安全头部 ==========
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    client_max_body_size 4096m;
    access_log /var/log/nginx/jenkins_access.log;

    location / {
        proxy_pass http://10.0.2.15:8080;

        # 核心代理头
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Ssl on;

        # WebSocket支持
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 超时设置
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        # 防止请求重复
        proxy_next_upstream off;
    }
}

重启nginx生效

docker restart nginx

查看证书过期时间 下面命令两个域名都需要替换

echo | openssl s_client -servername jenkinss.relatedyuan.dpdns.org -connect jenkinss.relatedyuan.dpdns.org:443 2>/dev/null | openssl x509 -noout -dates

手动生成新的域名证书 (记录 文档并未使用)

certbot certonly -d jenkinss.relatedyuan.dpdns.org --manual --preferred-challenges dns

证书续期 (记录 文档并未使用)

certbot renew --cert-name jenkinss.relatedyuan.dpdns.org --manual --preferred-challenges dns