Rancher v1.x 使用手册之三 安装Rancher并启用SSL

$ sudo docker run -d --restart=unless-stopped --name=rancher-server rancher/server

upstream rancher {
    server rancher-server:8080;
}
map $http_upgrade $connection_upgrade {
    default Upgrade;
    ''      close;
}
server {
    listen 443 ssl spdy;
    server_name ;
    ssl_certificate ;
    ssl_certificate_key ;
    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://rancher;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
        proxy_read_timeout 900s;
    }
}
server {
    listen 80;
    server_name ;
    return 301 https://$server_name$request_uri;
}

  ServerName 
  Redirect / https:///

 

  ServerName 
 
  SSLEngine on
  SSLCertificateFile 
  SSLCertificateKeyFile 
 
  ProxyRequests Off
  ProxyPreserveHost On
 
  RewriteEngine On
  RewriteCond %{HTTP:Connection} Upgrade [NC]
  RewriteCond %{HTTP:Upgrade} websocket [NC]
  RewriteRule /(.*) ws://rancher:8080/$1 [P,L]
 
  RequestHeader set X-Forwarded-Proto "https"
  RequestHeader set X-Forwarded-Port "443"
 
  
    ProxyPass "http://rancher:8080/"
    ProxyPassReverse "http://rancher:8080/"
  
 

global
  maxconn 4096
  ssl-server-verify none
 
defaults
  mode http
  balance roundrobin
  option redispatch
  option forwardfor
 
  timeout connect 5s
  timeout queue 5s
  timeout client 36000s
  timeout server 36000s
 
frontend http-in
  mode http
  bind *:443 ssl crt /etc/haproxy/certificate.pem
  default_backend rancher_servers
 
  # Add headers for SSL offloading
  http-requ服务器托管网est set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Ssl on if { ssl_fc }
 
  acl is_websocket hdr(Upgrade) -i WebSocket
  acl is_websocket hdr_beg(Host) -i ws
  use_backend rancher_servers if is_websocket
 
backend rancher_servers
  server websrv1 :8080 weight 1 maxconn 1024
  server websrv2 :8080 weight 1 maxconn 1024
  server websrv3 :8080 w服务器托管网eight 1 maxconn 1024

when HTTP_REQUEST {
  HTTP::header insert "X-Forwarded-Proto" "https";
  HTTP::header insert "X-Forwarded-Port" "443";
  HTTP::header insert "X-Forwarded-For" [IP::client_addr];
}

$ aws elb create-load-balancer-policy --load-balancer-name  --policy-name  --policy-type-name ProxyProtocolPolicyType --policy-attributes AttributeName=ProxyProtocol,AttributeValue=true
$ aws elb set-load-balancer-policies-for-backend-server --load-balancer-name  --instance-port 443 --policy-names 
$ aws elb set-load-balancer-policies-for-backend-server --load-balancer-name  --instance-port 8080 --policy-names 

   $ sudo docker run -d --restart=unless-stopped -p 8080:8080 -v /some/dir/cert.crt:/var/lib/rancher/etc/ssl/ca.crt rancher/server

 
> **注意:** 如果您在容器内部运行NGINX或者Apache，您可以直接链接这个实例并且不需要暴露Rancher UI的8080端口。
 
这个命令将会配置服务器的ca-certificate，从而使Rancher的主机创建服务，应用商店服务和Compose执行服务可以与Rancher Server通信。