xalauc/haproxy-certbot

HAProxy with Certbot镜像说明

本镜像基于https://github.com/nmarus/docker-haproxy-certbot%E9%A1%B9%E7%9B%AE%E4%BF%AE%E6%94%B9%EF%BC%8C%E7%94%A8%E4%BA%8E%E5%BF%AB%E9%80%9F%E9%83%A8%E7%BD%B2%E6%94%AF%E6%8C%81HTTPS%E8%AF%81%E4%B9%A6%E8%87%AA%E5%8A%A8%E7%AE%A1%E7%90%86%E7%9A%84%E5%8F%8D%E5%90%91%E4%BB%A3%E7%90%86%E6%9C%8D%E5%8A%A1%E3%80%82

核心功能

1. 基于Alpine Linux构建，轻量高效
2. 集成HAProxy 1.7.9反向代理服务
3. 内置Certbot工具，支持自动获取、更新Let's Encrypt证书
4. 提供配置检查脚本，验证HAProxy配置有效性
5. 支持Docker网络连接，适配多容器服务架构

使用场景

• 网站HTTPS协议部署与证书自动续期
• 多后端服务的反向代理与负载均衡
• 小型应用或个人项目的安全访问层搭建

配置说明

1. 创建容器

bash
docker run -d \
  --restart=always \
  --name haproxy-certbot \
  --net=bridge \
  --cap-add=NET_ADMIN \
  -p 80:80 \
  -p 443:443 \
  -v /docker/haproxy/config:/config \
  -v /docker/haproxy/letsencrypt:/etc/letsencrypt \
  -v /docker/haproxy/certs.d:/usr/local/etc/haproxy/certs.d \
  xalauc/haproxy-certbot

2. 验证配置有效性

bash
docker exec -it haproxy-certbot haproxy-check

或使用临时容器检查：

bash
docker run -it --rm \
  -v /docker/haproxy/config/haproxy.cfg:/haproxy.cfg:ro \
  -v /docker/haproxy/letsencrypt:/etc/letsencrypt \
  -v /docker/haproxy/certs.d:/usr/local/etc/haproxy/certs.d \
  --net=internal haproxy:alpine -c -f /haproxy.cfg

3. 连接自定义Docker网络

bash
docker network connect my_custom_network haproxy-certbot

4. 生成证书（测试模式）

bash
docker exec haproxy-certbot certbot-certonly \
  --domain example.com \
  --domain www.example.com \
  --email your-email@example.com \
  --dry-run

（正式生成时移除--dry-run参数）

5. 更新证书并刷新HAProxy配置

bash
docker exec haproxy-certbot haproxy-refresh

示例HAProxy配置

global
  maxconn 1028
  log 127.0.0.1 local0
  log 127.0.0.1 local1 notice
  ca-base /etc/ssl/certs
  crt-base /etc/ssl/private
  ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
  ssl-default-bind-options no-sslv3

defaults
  log global
  mode http
  option httplog
  option dontlognull
  timeout connect 5000
  timeout client ***
  timeout server ***
  default-server init-addr none

resolvers docker_resolver
  nameserver dns 127.0.0.11:53

frontend http-in
  bind 0.0.0.0:80
  mode http
  reqadd X-Forwarded-Proto:\ http
  acl letsencrypt_http_acl path_beg /.well-known/acme-challenge/
  redirect scheme https if !letsencrypt_http_acl
  use_backend letsencrypt_http if letsencrypt_http_acl

frontend https-in
  bind *:443 ssl crt /usr/local/etc/haproxy/default.pem crt /usr/local/etc/haproxy/certs.d ciphers ECDHE-RSA-AES256-SHA:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM
  mode http
  reqadd X-Forwarded-Proto:\ https
  use_backend my-default-backend

backend letsencrypt_http
  mode http
  server letsencrypt_http_srv 127.0.0.1:8080

backend my-default-backend
  mode http
  balance roundrobin
  server app_node1 docker_container_name1:80 check inter 5s resolvers docker_resolver resolve-prefer ipv4
  server app_node2 docker_container_name2:80 check inter 5s resolvers docker_resolver resolve-prefer ipv4