onaci/caddy

onaci/caddy Docker反向代理服务器

onaci/caddy是基于[***] Compose和Swarm部署场景。

核心功能

• 自动申请SSL证书（支持LetsEncrypt、自定义证书、自签名证书等）
• 通过Docker镜像/容器/Swarm服务标签配置用户端端点到容器的代理规则
• 支持本地、LDAP、OAuth 2.0、SAML等多种认证后端
• 基于角色的用户授权（角色信息通过HTTP请求头传递给上游容器）
• 支持跨域资源共享（CORS）配置

使用场景

• 生产环境作为服务入口，统一处理HTTPS加密和身份认证
• 开发测试环境快速搭建HTTPS代理，避免手动配置证书的繁琐
• 内部服务需要身份验证和权限控制的场景

配置说明

Docker Socket挂载

需将主机的/var/run/docker.sock挂载到容器内相同路径，以便镜像读取其他容器的标签信息，实现动态路由配置。

持久化卷

需挂载两个持久化卷：

• /config：存储配置文件（勿使用nocopy属性，避免覆盖默认配置）
• /data：存储SSL证书等数据（防止容器重启后重新申请证书触发LetsEncrypt速率限制）

关键环境变量

• TLS_EMAIL：LetsEncrypt证书注册***
• DNS_DOMAIN：服务基础域名
• AUTH_TOKEN_SECRET：JWT认证令牌密钥（需自定义安全值）
• GANDI_ACCESS_TOKEN：Gandi DNS挑战所需令牌（可选，用于DNS验证方式的SSL证书申请）

TLS证书配置

支持四种证书方式：

1. 自定义证书：通过TLS_LOCAL_CRT和TLS_LOCAL_KEY指定证书和密钥路径
2. LetsEncrypt HTTP挑战：设置TLS_EMAIL即可（需主机可被公网访问）
3. LetsEncrypt DNS挑战（Gandi）：设置GANDI_ACCESS_TOKEN和TLS_EMAIL
4. 自签名证书：通过对应环境变量配置

部署示例

Docker Compose示例

yaml
version: "3.8"

networks:
  caddy-ingress:
    attachable: true
    name: caddy-ingress

volumes:
  caddy-config:
  caddy-data:

services:
  caddy:
    container_name: caddy
    image: onaci/caddy:latest
    environment:
      AUTH_UI_LOGO_URL: https://static.example.com/logo.svg
      AUTH_UI_LOGO_DESCRIPTION: "我的认证门户"
      AUTH_UI_SUPPORT_URL: mailto:support@example.com
      DNS_DOMAIN: example.com
      TLS_EMAIL: sysadmin@example.com
    networks:
      - caddy-ingress
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - caddy-config:/config
      - caddy-data:/data

  landing_page:
    container_name: "landing"
    image: onaci/echo:latest
    labels:
      # 无认证访问https://example.com
      virtual.host: "@"
      virtual.port: 80
      virtual.link_title: "首页"
      # 需要认证和data-viewer角色访问https://example.com/data/
      virtual_0.host: "@"
      virtual_0.path: "/data*"
      virtual_0.port: 80
      virtual_0.auth_roles: "data-viewer"
      virtual_0.link_title: "数据探索"
      virtual_0.link_path: "/data/"
      virtual_0.link_icon: "star"
    networks:
      - caddy-ingress

  microservice:
    container_name: "api"
    image: onaci/echo:latest
    labels:
      # 需要认证访问https://api.example.com，允许来自example.com的跨域
      virtual.host: api
      virtual.auth: true
      virtual.cors_allow_origin: https://example.com
      virtual.port: 80
      # 将/api/help重定向到首页对应路径
      virtual_0.host: api
      virtual_0.path: /help
      virtual_0.redirect: "https://example.com{uri} 303"
    networks:
      - caddy-ingress

Docker Swarm示例

yaml
version: "3.8"

secrets:
  caddy-auth-backend:
    file: /path/to/custom-backend.caddyfile
  caddy-secret-key:
    file: /path/to/caddy-key.txt
  gandi-access-token:
    file: /path/to/gandi-key.txt

networks:
  caddy-ingress:
    attachable: true
    name: caddy-ingress
    driver: overlay

volumes:
  caddy-config:
  caddy-data:

services:
  caddy:
    deploy:
      mode: global
      placement:
        constraints:
          - node.role == manager
      restart-policy:
         condition: any
    environment:
      AUTH_SETTINGS_GLOBAL: /config/caddy/auth/custom-global-settings.caddyfile
      AUTH_SETTINGS_PORTAL: /config/caddy/auth/custom-portal-settings.caddyfile
      AUTH_TOKEN_SECRET_FILE: /run/secrets/caddy-secret-key
      AUTH_UI_LOGO_URL: [***]
      AUTH_UI_LOGO_DESCRIPTION: "我的认证门户"
      AUTH_UI_SUPPORT_URL: mailto:***
      DNS_DOMAIN: example.com
      GANDI_ACCESS_TOKEN_FILE: /run/secrets/gandi-access-token
      TLS_*** ***
    image: onaci/caddy:latest
    networks:
      - caddy-ingress
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
    secrets:
        caddy-auth-backend: /config/caddy/auth/custom-backend.caddyfile
        caddy-secret-key: /run/secrets/caddy-secret-key
        gandi-access-token: /run/secrets/gandi-access-token
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - caddy-config:/config
      - caddy-data:/data

  landing_page:
    container_name: "landing"
    image: onaci/echo:latest
    deploy:
      restart-policy:
         condition: on-failure
      mode: replicated
      replicas: 2
      labels:
         # 无认证访问[***]
         virtual.host: "@"
         virtual.port: 80
         virtual.link_title: "首页"
         # 需要认证和data-viewer角色访问[***]
         virtual_0.host: "@"
         virtual_0.path: "/data*"
         virtual_0.port: 80
         virtual_0.auth_roles: "data-viewer"
         virtual_0.link_title: "数据探索"
         virtual_0.link_path: "/data/"
         virtual_0.link_icon: "star"
    networks:
      - caddy-ingress

  microservice:
    container_name: "api"
    image: onaci/echo:latest
    deploy:
      restart-policy:
         condition: on-failure
      mode: replicated
      replicas: 2
      labels:
         # 需要认证访问[***]
         virtual.host: api
         virtual.auth: true
         virtual.cors_allow_origin: [***]
         virtual.port: 80
         # 将/api/help重定向到首页对应路径
         virtual_0.host: api
         virtual_0.path: /help
         virtual_0.redirect: "[***]{uri} 303"
    networks:
      - caddy-ingress