94 lines
3.0 KiB
Markdown
94 lines
3.0 KiB
Markdown
|
|
||
|
|
```
|
||
|
|
version: "3.8"
|
||
|
|
|
||
|
|
services:
|
||
|
|
squid:
|
||
|
|
image: ubuntu/squid:latest
|
||
|
|
container_name: squid-proxy
|
||
|
|
restart: unless-stopped
|
||
|
|
volumes:
|
||
|
|
- ./config/squid.conf:/etc/squid/squid.conf:ro
|
||
|
|
- squid_cache:/var/spool/squid
|
||
|
|
- squid_logs:/var/log/squid
|
||
|
|
networks:
|
||
|
|
- proxy-net
|
||
|
|
- traefik
|
||
|
|
# 只在本地暴露端口（可选，用于调试）
|
||
|
|
ports:
|
||
|
|
# - "127.0.0.1:3128:3128"
|
||
|
|
healthcheck:
|
||
|
|
test: ["CMD", "squidclient", "-h", "localhost", "mgr:info", "||", "exit", "1"]
|
||
|
|
interval: 30s
|
||
|
|
timeout: 10s
|
||
|
|
retries: 3
|
||
|
|
start_period: 40s
|
||
|
|
labels:
|
||
|
|
- "traefik.enable=true"
|
||
|
|
- "traefik.docker.network=traefik"
|
||
|
|
|
||
|
|
# Squid 管理界面路由
|
||
|
|
#- "traefik.http.routers.squid-mgr.rule=Host(`squid.yourdomain.com`) && PathPrefix(`/squid-internal-mgr`)"
|
||
|
|
#- "traefik.http.routers.squid-mgr.entrypoints=websecure"
|
||
|
|
#- "traefik.http.routers.squid-mgr.tls.certresolver=letsencrypt"
|
||
|
|
#- "traefik.http.routers.squid-mgr.middlewares=squid-auth"
|
||
|
|
#- "traefik.http.services.squid-mgr.loadbalancer.server.port=3128"
|
||
|
|
|
||
|
|
# Basic Auth 中间件
|
||
|
|
#- "traefik.http.middlewares.squid-auth.basicauth.users=admin:$$apr1$$8EVjn/nj$$GiLUZqcbueTFeD23SuB6x0"
|
||
|
|
|
||
|
|
nghttpx:
|
||
|
|
image: jehrhart/nghttp2docker
|
||
|
|
container_name: nghttpx-proxy
|
||
|
|
restart: unless-stopped
|
||
|
|
volumes:
|
||
|
|
- ./config/nghttpx.conf:/nghttpx/nghttpx.conf:ro
|
||
|
|
command: nghttpx --conf /nghttpx/nghttpx.conf
|
||
|
|
depends_on:
|
||
|
|
squid:
|
||
|
|
condition: service_healthy
|
||
|
|
networks:
|
||
|
|
- proxy-net
|
||
|
|
- traefik
|
||
|
|
healthcheck:
|
||
|
|
test: ["CMD", "curl", "-f", "http://localhost:8080/", "||", "exit", "1"]
|
||
|
|
interval: 30s
|
||
|
|
timeout: 10s
|
||
|
|
retries: 3
|
||
|
|
start_period: 10s
|
||
|
|
labels:
|
||
|
|
- "traefik.enable=true"
|
||
|
|
- "traefik.docker.network=traefik"
|
||
|
|
|
||
|
|
# HTTP/2 代理主路由
|
||
|
|
- "traefik.http.routers.nghttpx.rule=Host(`proxy.yourdomain.com`)"
|
||
|
|
- "traefik.http.routers.nghttpx.entrypoints=websecure"
|
||
|
|
- "traefik.http.routers.nghttpx.tls.certresolver=letsencrypt"
|
||
|
|
- "traefik.http.routers.nghttpx.tls.options=modern@file"
|
||
|
|
- "traefik.http.services.nghttpx.loadbalancer.server.port=8080"
|
||
|
|
|
||
|
|
# HTTP 到 HTTPS 重定向
|
||
|
|
- "traefik.http.routers.nghttpx-http.rule=Host(`proxy.yourdomain.com`)"
|
||
|
|
- "traefik.http.routers.nghttpx-http.entrypoints=web"
|
||
|
|
- "traefik.http.routers.nghttpx-http.middlewares=redirect-to-https@docker"
|
||
|
|
|
||
|
|
# 中间件
|
||
|
|
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
|
||
|
|
- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
|
||
|
|
|
||
|
|
# 可选：添加速率限制
|
||
|
|
- "traefik.http.routers.nghttpx.middlewares=rate-limit@docker"
|
||
|
|
- "traefik.http.middlewares.rate-limit.ratelimit.average=100"
|
||
|
|
- "traefik.http.middlewares.rate-limit.ratelimit.burst=50"
|
||
|
|
|
||
|
|
networks:
|
||
|
|
traefik:
|
||
|
|
external: true
|
||
|
|
|
||
|
|
volumes:
|
||
|
|
squid_cache:
|
||
|
|
driver: local
|
||
|
|
squid_logs:
|
||
|
|
driver: local
|
||
|
|
|
||
|
|
```
|