使用caddy2,docker-compose快速部署一个自带TLS和HTTP3的网站

2022-12-11 Yazzyk

使用背景

发现Caddy是我刚刚将博客换了个服务器,一时兴起,听闻IETF已经在今年(22年6月)推出了正式版HTTP3(RFC9114),那就干脆使得博客支持上,但找了半天,基于nginx都没有一个简单的方案,都是要去编译nginx-quic然后修改配置文件,看着就感觉好麻烦,也没有找到合适的docker来支持,弄完还得去弄证书来开启https。偶然间又看到一篇文章利用Caddy轻松HTTPS,支持HTTP3/QUIC,然后查了一下,发现caddy这个web服务器已经是默认支持HTTP3了,而且还可以自动去生成TLS证书,自动开启https,官方支持docker,那不快乐起来了吗!

简介

Caddy是一款用Golang编写的开源的web服务器,相比于Nginx来说有着以下优点

  1. 可自动获取TLS证书
  2. 自动续签证书
  3. 默认支持HTTP3(RFC9114)协议
  4. 配置文件简单易上手

docker-compose.yml

version: "3.7"

services:
  caddy:
    container_name: caddy-server
    image: caddy:2.6.2
    restart: always
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - $PWD/Caddyfile:/etc/caddy/Caddyfile
      - $PWD/site:/srv
      - $PWD/caddy_data:/data
      - $PWD/caddy_config:/config

创建一些映射出来的文件和文件夹

docker-compose.yml同目录下

mkdir site
mkdir caddy_data
mkdir caddy_config
touch Caddyfile

编辑Caddyfile(当然,也可以启动docker容器后copy出来)

# The Caddyfile is an easy way to configure your Caddy web server.
#
# Unless the file starts with a global options block, the first
# uncommented line is always the address of your site.
#
# To use your own domain name (with automatic HTTPS), first make
# sure your domain's A/AAAA DNS records are properly pointed to
# this machine's public IP, then replace ":80" below with your
# domain name.

:80 {
        # Set this path to your site's directory.
        root * /usr/share/caddy

        # Enable the static file server.
        file_server

        # Another common task is to set up a reverse proxy:
        # reverse_proxy localhost:8080

        # Or serve a PHP site through php-fpm:
        # php_fastcgi localhost:9000
}

shroot.dev {
        root * /srv/shroot.dev
        encode gzip zstd
        file_server
}

www.shroot.dev {
        redir https://shroot.dev/{uri}
}
# Refer to the Caddy docs for more information:
# https://caddyserver.com/docs/caddyfile

简单说下配置文件

以上我们就配置好了,接下来只需要将构建好的网站放入site/shroot.dev目录下,然后执行docker-compose up -d即可

httpshttp3不需要任何的配置,caddy默认支持并开启,并且会自动跳转到https,我们只需要检查服务器的防火墙是否开启80和443端口,注意443端口是tcp和udp都打开,http3使用的是udp

检查

docker ps检查容器是否运行正常

访问域名检查是否开启httpshttp3,如果Chrome没有Protocol,可以在Name那里鼠标右键勾上Protocol即可

如果在https://http3check.net/https://geekflare.com/tools/http3-test检查说网站不是Http3的话,其实可能是检查的网站协议不是最新的,而caddy已经不支持旧版的草案了,参考v2.6.0: HTTP/3 fails test on http3check.net #5069