用 Docker 来构建 Jumpserver

说明: 项目从 [ Jumpserver 官方 ] fork 而来.

主要更新:

• OS: ubuntu:18.04
• 优化了 Dockerfile
• Jumpserver 版本: 1.4.0
• redis 运行在容器内
• mysql 从容器中摘离了出来

环境依赖

• mysql 版本: 5.7.23 (查看 [ 这里 ])
• mysql 数据库的字符编码为 : utf8.

运行容器时环境变量的缺省选项为

DB_ENGINE=mysql

DB_HOST=172.17.0.1

DB_USER=jms

DB_PASSWORD=jumpserver

DB_NAME=jumpserver

DB_PORT=3306

用 Docker 来构建 Jumpserver

准备数据库 mysql

docker volume create jms_mysql

docker run -d --name jms_mysql \

    --restart=always \

    -e "MYSQL_ROOT_PASSWORD=testpw" \

    -v jms_mysql:/var/lib/mysql mysql:5.7.23

登录 mysql 创建数据库

docker exec -it jms_mysql mysql -uroot -ptestpw

mysql> CREATE DATABASE `jumpserver` CHARACTER SET utf8;

mysql> GRANT ALL PRIVILEGES ON `jumpserver`.* TO 'jms'@'172.17.%' IDENTIFIED BY "jumpserver";

mysql> FLUSH PRIVILEGES;

创建 jumpserver 镜像

git clone https://github.com/Tiantiandas/jumpserver.git

cd jumpserver

docker build -t xxx/jumpserver<:tag> .

也可以从 dockerhub 获取

docker pull zhegao/jumpserver

运行 jumpserver 容器

docker run -d --name jms_server \

    -p 8080:80 \

    -p 2222:2222 \

    --link jms_mysql:mysql \

    -e "DB_HOST=jms_mysql" \

    -e "DB_USER=<mysql_user>" \

    -e "DB_PASSWORD=<mysql_password>" \

    -e "DB_NAME=<mysql_dbname>" \

    -e "DB_PORT=<mysql_port>" \

    zhegao/jumpserver

宿主机 nginx 配置

因为 coco 是 websocket 服务, 需要指定 Upgrade Header 以及 http_version.

upstream jumpserver{

    server 127.0.0.1:8080;

}

server {

    listen 80;

    server_name  _;

    proxy_set_header X-Real-IP $remote_addr;

    proxy_set_header Host $host;

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_set_header X-Forwared-Proto "http";

    location / {

        proxy_pass http://jumpserver;

    }

    location /media/ {

        add_header Content-Encoding gzip;

        proxy_pass http://jumpserver;

    }

    location /socket.io/ {

        proxy_pass       http://jumpserver;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

    }

    error_page 404 /404.html;

        location = /40x.html {

    }

    error_page 500 502 503 504 /50x.html;

        location = /50x.html {

    }

}

SSL 证书生成

[ letsencrypt ]

使用 mkcert 生成证书

# centos

yum -y install golang nss-tools

# ubuntu

apt-get install golang libnss3-tools

git clone https://github.com/FiloSottile/mkcert.git

cd mkcert && make

mv bin/mkcert /bin

mkcert install

具体使用可使用: mkcert --help