Ikhonteyina ayifinyeleli i-API yokuphela kwe-VPN? Yenza iproksi kumsingathi

Umhubhe uhlala kumsingathi, ngakho ikhonteyina ayinawo umzila oya ekhelini langasese. Shicilela iproksi ephambene encane bese uyibiza ngegama elithi host.docker.internal.

Isevisi yakho ye-Compose iphelelwa isikhathi ku-API evulwa isiphequluli kulo mismo umshini ngaphandle kwesikhalo. Lowo mehluko uwumkhondo: isicelo esisebenzayo siphuma kumsingathi onomhubhe we-VPN, kanti isicelo esilengayo siphuma kukhonteyina enenqwaba yayo yenethiwekhi. Akukho lutho ngaphakathi kwekhonteyina olwazi imizila yomhubhe, ngakho indawo yangasese ihlala ingafinyeleleki noma igama libhalwa kanjani. Isixazululo ukugxuma ngamabomu kumsingathi, hhayi ithebula lomzila elihlakaniphe kakhulu.

Qala ngokuthi kungani izindlela ezimbili zehluka, bese unquma ukuthi umhubhe kufanele uhlale kuphi.

Kungani umsingathi usebenza kanti ikhonteyina ayisebenzi

Ukwakha umhubhe kunika umsingathi isixhumanisi, iqoqo lemizila futhi ngokuvamile umugqa wesixazululi ohlinzekwa yi-VPN. Ikhonteyina ayilitholi lutho kulokhu njengefa: iqala ngesixhumanisi esisodwa ebhulohweni lwenjini kanye nomzila ozenzakalelayo okhombisa kulelo bhuloho. Imizila efakwe kumsingathi ayibonakali kunoma yini esebenza ngaphakathi kwaleso sikhala samagama.

Yingakho izimpawu zibonakala zingahambisani hhayi nje ziphukile. Umsingathi uxazulula igama langasese futhi uxhumanisa, ngoba igama nomzila kokubili kukhona lapho. Ikhonteyina ithumela iphakethe layo ekhelini langasese okungekho lutho emzileni webhuloho olungafinyelela kulo, futhi isicelo siphelelwa isikhathi. Ukwengeza igama kufayela le-hosts lekhonteyina akushintshi lutho, ngoba ikheli ngokwalo alifinyeleleki ukusuka lapho ikhonteyina ikhona.

Finyelela umsingathi ngaphakathi kwekhonteyina

Inqubo ngaphakathi kwekhonteyina eshayela i-localhost ishayela ikhonteyina. I-Docker Desktop ishicilela i-host.docker.internal njengegama elikhombisa emuva emshinini osebenzisa injini; izinjini ze-Linux ziyishiya ingachazwanga ngaphandle uma isevisi iyicela, futhi yilokho okwenziwa umdwebo ongezansi. Ngalokho uhlelo luhlose igama kanye nechweba esikhundleni sekheli langasese.

services:
  app:
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      INTERNAL_API_HOST: "host.docker.internal:8666"

Umhubhe uhlala ohlangothini lomsingathi walokhu kugxuma, futhi ichweba kulelo guquko yilona iproksi ezolalela kulo. Ikhonteyina elahlekelwa umhubhe manje yehluleka ekugxumeni okukodwa okwaziwayo esikhundleni sokuzama umzila engakaze ube nawo.

Khetha lapho umhubhe uhlala khona

Izimo ezintathu zingenzeka kusevisi ye-Compose edinga i-API yangasese, futhi ziyahluka ngokuthi iyiphi inqubo ephethe umhubhe. Iklayenti le-VPN lingasebenza ngaphakathi kwesithombe sekhonteyina, okudinga ukuveza idivaysi yomhubhe nokunikeza amandla okuphatha inethiwekhi ahamba nawo. Uhlelo lungabelana ngesikhala samagama senethiwekhi sekhonteyina ehlukile yomhubhe, ukuze zombili izinqubo zibone inqwaba eyodwa nethebula lomzila elilodwa. Noma umhubhe ungahlala kumsingathi, ngomdlulisi omncane osuka kumsingathi uya ekhonteyini.

Ezimbili zokuqala zidonsa amafayela ephrofayela, ukuziphatha kokuxhuma kabusha kanye nenqubomgomo yesixazululi kungene kuphrojekthi, futhi zenza yonke isevisi kufayela incike empilweni yomhubhe. Lokho kuwukuhlangana okukhulu kakhulu kocingo lwe-API olulodwa. Kunqwaba yentuthuko efunda indawo eyodwa yangaphakathi, umdlulisi ohlangothini lomsingathi uyinguquko encane kunazo zonke egcina imininingwane yokungena lapho ithimba leplatifomu liyiphatha khona.

Shicilela umzila owodwa omncane kumsingathi

Qala ngalokho umdlulisi akuthola njengefa: wusebenzise ngaphansi kwe-akhawunti ephethe umhubhe, futhi amasokhethi ayo aphumayo azothatha imizila yomsingathi kanye nesixazululi somsinsgathi. Ibhlokhi eyodwa ye-location ye-nginx ihlanganisa umzila owodwa.

server {
    listen 8666;
    location /search/ {
        proxy_pass http://10.20.30.40:8090/;
        proxy_set_header Host internal-api.example;
        proxy_read_timeout 60s;
    }
}

Thatha ikheli nechweba njengezinto zesikhashana bese ufaka ipheya i-API elalela kulo ngempela. Yonke i-upstream eyengeziwe ifanelwe ibhlokhi yayo ye-location, futhi ibhlokhi ngayinye kufanele ivumele kuphela imizila ebizwa yile sevisi, ukuze iproksi ingabi umnyango ojwayelekile wokungena kunethiwekhi yangasese. Bopha isilaleli ekhelini lebhuloho kumaklayenti afika nge-host-gateway, ku-loopback kuphela lapho iklayenti labelana ngesikhala samagama senethiwekhi somsinsgathi, futhi ungalokothi ubophe ku-0.0.0.0. Futhi khetha ichweba elisakhululekile: inombolo esivele ithathiwe ishiya iproksi ingalaleli ngenkathi ikhonteyina iqhubeka nokuphelelwa isikhathi, okungeke kwehlukaniswe nephutha lenethiwekhi oqale ngalo.

Amachweba, amagama kanye nesinqumo se-TLS

Ukuxazululwa kwamagama kuhlukaniswa ngendlela efanayo nokuhlinzekwa kwemizila. Ukusesha komphakathi kwekhonteyina kudlula kusixazululi senjini, ngakho igama langasese elixazululwa kumsingathi ngeke lixazululwe ngaphakathi kwekhonteyina. Iproksi iyingxenye exazulula igama langasese, ngoba ithola isixazululi somsinsgathi njengefa.

I-TLS yisinqumo esihlehliswayo esibe sesichaza ukwehluleka okulandelayo. Uma iproksi idlulisa amabhayithi ingawathintanga, ikhonteyina ibona isitifiketi se-API uqobo futhi idinga i-CA yangaphakathi esitolo sayo sokuthembela. Uma iproksi iqeda i-TLS, lokho kuthembela kudlulela kumsingathi futhi uhlelo luqale ukwakha izixhumanisi kusukela kusihloko se-host esikutholayo. Khetha ukuhleleka okukodwa bese ukusebenzisa kuyo yonke insiza, ngoba ukudluliselwa okukhishwa kwelinye kukhombisa igama lomsingathi ikhonteyina engakwazi ukulixazulula.

Qinisekisa ngaphakathi kwesevisi

Thumela isicelo sisuka ekhonteyini, hhayi kumsingathi: i-curl elula emzileni weproksi, bese kuba ukuhlolwa kwempilo kohlelo uqobo. Uma iproksi iphendula kodwa uhlelo lusahluleka, qhathanisa izinto ezintathu: i-URL eyisisekelo eluyakhayo, noma yikuphi ukuguquka kweproksi endaweni yalo, kanye ne-CA eluthembelayo. Konke kusendaweni nasemarekhodini ekhonteyina, futhi ukulungisa noma yikuphi kulokhu kushiya i-VPN ngokuthula.

Bhala ukuhleleka okukhethiwe ku-README yephrojekthi ngenkathi kusasha. Uma kungenjalo umuntu olandelayo ozohlangana nalesi sikhathi sokuphela uzochitha intambama efanayo ethola kabusha ukuthi umhubhe uhlala kumsingathi.

Izihloko ezihlobene