自建 Traefik 网关：HTTPS 打不开的完整排查路径

1
name: coolify-proxy
2
networks:
3
  coolify:
4
    external: true
5
  traefik-net:
6
    external: true
7
services:
8
  traefik:
9
    container_name: coolify-proxy
10
    image: traefik:v3.7
11
    restart: unless-stopped
12
    extra_hosts:
13
      - host.docker.internal:host-gateway
14
    environment:
15
      - TZ=Asia/Shanghai
16
      - CF_DNS_API_TOKEN=   # 必改：权限需 Zone:DNS:Edit + Zone:Zone:Read
17
    networks:
18
      - coolify
19
      - traefik-net
20
    ports:
21
      # 绑定内网 IP 而非全网卡：宿主机上 8080 常被占用，且避免对外暴露
22
      - 192.168.1.10:80:80
23
      - 192.168.1.10:443:443
24
      - 192.168.1.10:8080:8080
25
      - 192.168.1.10:8888:8888
26
    healthcheck:
27
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/ping || exit 1"]
28
      interval: 4s
29
      timeout: 2s
30
      retries: 5
31
    logging:
32
      driver: json-file
33
      options:
34
        max-size: 10m
35
        max-file: "3"
36
    volumes:
37
      - /var/run/docker.sock:/var/run/docker.sock:ro
38
      - /data/coolify/proxy/:/traefik
39
    command:
40
      - --ping=true
41
      - --global.checknewversion=false
42
      - --global.sendanonymoususage=false
43
      - --log.level=INFO
44
      - --accesslog=true
45
      - --accesslog.format=json
46
      - --api.dashboard=true
47
      - --api.insecure=true
48
      - --providers.docker=true
49
      - --providers.docker.exposedbydefault=false
50
      - --providers.docker.network=traefik-net
51
      - --providers.file.directory=/traefik/dynamic/
52
      - --providers.file.watch=true
53
      - --entrypoints.web.address=:80
54
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
55
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
56
      - --entrypoints.websecure.address=:443
57
      - --entrypoints.web-cf.address=:8888
58
      - --entrypoints.web-cf.forwardedHeaders.trustedIPs=127.0.0.1/32,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
59
      - --certificatesresolvers.cloudflare.acme.dnschallenge=true
60
      - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
61
      # 指定公共 DNS 解析器：本地 DNS 被污染或缓存时，传播检查会一直失败
62
      - --certificatesresolvers.cloudflare.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53
63
      - --certificatesresolvers.cloudflare.acme.dnschallenge.delaybeforecheck=30
64
      - --certificatesresolvers.cloudflare.acme.email=   # 必改：真实可收信地址
65
      - --certificatesresolvers.cloudflare.acme.storage=/traefik/acme.json
66
    labels:
67
      - traefik.enable=true
68
      # ---- secure-headers ----
69
      - traefik.http.middlewares.secure-headers.headers.frameDeny=true
70
      - traefik.http.middlewares.secure-headers.headers.contentTypeNosniff=true
71
      - traefik.http.middlewares.secure-headers.headers.referrerPolicy=strict-origin-when-cross-origin
72
      - traefik.http.middlewares.secure-headers.headers.permissionsPolicy=camera=(), microphone=(), geolocation=()
73
      - traefik.http.middlewares.secure-headers.headers.stsSeconds=31536000
74
      - traefik.http.middlewares.secure-headers.headers.stsIncludeSubdomains=true
75
      # ---- compress ----
76
      - traefik.http.middlewares.compress.compress=true
77
      # ---- internal-only：仅内网来源，只能挂 websecure 路由 ----
78
      - traefik.http.middlewares.internal-only.ipallowlist.sourcerange=127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
79
      # ---- rate-limit：按 XFF 第 1 跳判定，只给隧道路由用 ----
80
      - traefik.http.middlewares.rate-limit.ratelimit.average=100
81
      - traefik.http.middlewares.rate-limit.ratelimit.burst=200
82
      - traefik.http.middlewares.rate-limit.ratelimit.sourcecriterion.ipstrategy.depth=1
83
      # ---- retry ----
84
      - traefik.http.middlewares.retry.retry.attempts=3
85
      - traefik.http.middlewares.retry.retry.initialInterval=100ms
86
      # ---- cors-allow ----
87
      - traefik.http.middlewares.cors-allow.headers.accessControlAllowOriginList=*
88
      - traefik.http.middlewares.cors-allow.headers.accessControlAllowHeaders=*
89
      - traefik.http.middlewares.cors-allow.headers.accessControlAllowMethods=GET,POST,PUT,PATCH,DELETE,OPTIONS
90
      - traefik.http.middlewares.cors-allow.headers.accessControlMaxAge=86400
91
      # ---- no-cache ----
92
      - traefik.http.middlewares.no-cache.headers.customResponseHeaders.Cache-Control=no-store
93
      # ---- 基础链：所有路由都挂 ----
94
      - traefik.http.middlewares.web-default.chain.middlewares=secure-headers@docker,compress@docker

1
services:
2
  tinyauth:
3
    container_name: tinyauth
4
    image: ghcr.io/steveiliop56/tinyauth:latest
5
    pull_policy: always
6
    user: 0:0
7
    restart: unless-stopped
8
    environment:
9
      - TZ=Asia/Shanghai
10
      - TINYAUTH_APPURL=https://   # 必改：登录页地址
11
      - TINYAUTH_AUTH_USERS=   # 必改：用户名:bcrypt 哈希，哈希里的 $ 双写成 $$
12
      # CIDR 要对齐：192.168.0.0/12 是错的，实际覆盖 192.160~192.175
13
      # 172.16/12 是 Docker 容器网段，Traefik 从容器网络过来，必须包含
14
      - TINYAUTH_AUTH_TRUSTEDPROXIES=192.168.0.0/16,172.16.0.0/12
15
      - TINYAUTH_AUTH_SESSIONEXPIRY=604800
16
      - TINYAUTH_UI_TITLE=   # 必改
17
      - TINYAUTH_UI_WARNINGSENABLED=false
18
    volumes:
19
      - ./data:/data
20
    healthcheck:
21
      test: ["CMD", "tinyauth", "healthcheck"]
22
      interval: 30s
23
      timeout: 5s
24
      retries: 3
25
      start_period: 10s
26
    logging:
27
      driver: json-file
28
      options:
29
        max-size: 10m
30
        max-file: "3"
31
    networks:
32
      - traefik-net
33
    labels:
34
      - traefik.enable=true
35
      - traefik.docker.network=traefik-net
36
      - traefik.http.services.tinyauth.loadbalancer.server.port=3000
37
      # ---- 全局中间件，其他项目以 tinyauth@docker 引用 ----
38
      # 地址里的 tinyauth 是服务名（网络别名），不是容器名，见坑五
39
      - traefik.http.middlewares.tinyauth.forwardauth.address=http://tinyauth:3000/api/auth/traefik
40
      - traefik.http.middlewares.tinyauth.forwardauth.authResponseHeaders=authorization
41
      - traefik.http.middlewares.tinyauth.forwardauth.trustForwardHeader=true
42
      - traefik.http.middlewares.tinyauth.forwardauth.maxResponseBodySize=8192
43
      # ---- 登录页本身不套 tinyauth，否则死循环 ----
44
      - traefik.http.routers.tinyauth.rule=Host(``)   # 必改
45
      - traefik.http.routers.tinyauth.entrypoints=web-cf
46
      - traefik.http.routers.tinyauth.middlewares=web-default@docker
47
      - traefik.http.routers.tinyauth.service=tinyauth
48
      - traefik.http.routers.tinyauth-lan.rule=Host(``)   # 必改
49
      - traefik.http.routers.tinyauth-lan.entrypoints=websecure
50
      - traefik.http.routers.tinyauth-lan.tls.certresolver=cloudflare
51
      - traefik.http.routers.tinyauth-lan.middlewares=web-default@docker
52
      - traefik.http.routers.tinyauth-lan.service=tinyauth
53

54
networks:
55
  traefik-net:
56
    external: true

1
services:
2
  myapp:
3
    container_name: myapp
4
    image: ghcr.io/example/myapp:latest
5
    restart: unless-stopped
6
    environment:
7
      - TZ=Asia/Shanghai
8
    volumes:
9
      - ./data:/data
10
    healthcheck:
11
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/health >/dev/null 2>&1 || exit 1"]
12
      interval: 30s
13
      timeout: 5s
14
      retries: 3
15
      start_period: 20s
16
    logging:
17
      driver: json-file
18
      options:
19
        max-size: 10m
20
        max-file: "3"
21
    networks:
22
      - traefik-net
23
    labels:
24
      - traefik.enable=true
25
      # 容器同时在多个网络时，必须指定 Traefik 该用哪个，否则可能路由到错误的网卡
26
      - traefik.docker.network=traefik-net
27
      - traefik.http.services.myapp.loadbalancer.server.port=8080
28
      # ---- 内网直连：灰云 A 记录指 NAS ----
29
      - traefik.http.routers.myapp-lan.rule=Host(``)   # 必改
30
      - traefik.http.routers.myapp-lan.entrypoints=websecure
31
      - traefik.http.routers.myapp-lan.tls.certresolver=cloudflare
32
      - traefik.http.routers.myapp-lan.middlewares=web-default@docker,internal-only@docker
33
      - traefik.http.routers.myapp-lan.service=myapp
34
      # ---- 公网隧道：橙云 CNAME 指隧道 ----
35
      - traefik.http.routers.myapp-cf.rule=Host(``)   # 必改
36
      - traefik.http.routers.myapp-cf.entrypoints=web-cf
37
      - traefik.http.routers.myapp-cf.middlewares=web-default@docker,tinyauth@docker
38
      - traefik.http.routers.myapp-cf.service=myapp
39

40
networks:
41
  traefik-net:
42
    external: true