标签归档:docker

Gitea 非标准端口配置代理注意点

这是官方给的例子:

server {
    ...
    location / {
        client_max_body_size 512M;
        proxy_pass http://localhost:3000;
        proxy_set_header Connection $http_connection;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

你访问Gitea的域名为非标端口(80,443)时,需要在Host上加上端口

server {
    ...
    location / {
        proxy_set_header Host $host:你的端口;
        ...
    }
}

原因是源码里取访问host时,没有取 X-Forwarded-For,而是取的Header里的Host

源码文件:modules/httplib/url.go 及内容处:

func GuessCurrentHostURL(ctx context.Context) string {
	req, ok := ctx.Value(RequestContextKey).(*http.Request)
	if !ok {
		return strings.TrimSuffix(setting.AppURL, setting.AppSubURL+"/")
	}
	// If no scheme provided by reverse proxy, then do not guess the AppURL, use the configured one.
	// At the moment, if site admin doesn't configure the proxy headers correctly, then Gitea would guess wrong.
	// There are some cases:
	// 1. The reverse proxy is configured correctly, it passes "X-Forwarded-Proto/Host" headers. Perfect, Gitea can handle it correctly.
	// 2. The reverse proxy is not configured correctly, doesn't pass "X-Forwarded-Proto/Host" headers, eg: only one "proxy_pass http://gitea:3000" in Nginx.
	// 3. There is no reverse proxy.
	// Without an extra config option, Gitea is impossible to distinguish between case 2 and case 3,
	// then case 2 would result in wrong guess like guessed AppURL becomes "http://gitea:3000/", which is not accessible by end users.
	// So in the future maybe it should introduce a new config option, to let site admin decide how to guess the AppURL.
	reqScheme := getRequestScheme(req)
	if reqScheme == "" {
		return strings.TrimSuffix(setting.AppURL, setting.AppSubURL+"/")
	}
	// X-Forwarded-Host has many problems: non-standard, not well-defined (X-Forwarded-Port or not), conflicts with Host header.
	// So do not use X-Forwarded-Host, just use Host header directly.
	return reqScheme + "://" + req.Host # 就是这里
}

分析过程就不写了,官方也说了为什么要取这个值,所以注意一下就好

docker配置pull代理

1.创建 dockerd 相关的 systemd 目录,这个目录下的配置将覆盖 dockerd 的默认配置

sudo mkdir -p /etc/systemd/system/docker.service.d

2.新建配置文件 /etc/systemd/system/docker.service.d/http-proxy.conf,这个文件中将包含环境变量

[Service]
Environment="HTTP_PROXY=http://proxy.example.com:80"
Environment="HTTPS_PROXY=https://proxy.example.com:443"

3.如果你自己建了私有的镜像仓库,需要 dockerd 绕过代理服务器直连,那么配置 NO_PROXY 变量:

[Service]
Environment="HTTP_PROXY=http://proxy.example.com:80"
Environment="HTTPS_PROXY=https://proxy.example.com:443"
Environment="NO_PROXY=your-registry.com,10.10.10.10,*.example.com"

4.重新加载配置文件,重启 dockerd

systemctl daemon-reload
systemctl restart docker

5.检查确认环境变量已经正确配置:

systemctl show --property=Environment docker