用 Docker 来构建 Jumpserver

说明: 项目从 [ Jumpserver 官方 ] fork 而来.

主要更新:

• OS: ubuntu:18.04
• 优化了 Dockerfile
• Jumpserver 版本: 1.4.0
• redis 运行在容器内
• mysql 从容器中摘离了出来

环境依赖

• mysql 版本: 5.7.23 (查看 [ 这里 ])
• mysql 数据库的字符编码为 : utf8.

运行容器时环境变量的缺省选项为

DB_ENGINE=mysql
DB_HOST=172.17.0.1
DB_USER=jms
DB_PASSWORD=jumpserver
DB_NAME=jumpserver
DB_PORT=3306

用 Docker 来构建 Jumpserver

准备数据库 mysql

docker volume create jms_mysql
docker run -d --name jms_mysql \
    --restart=always \
    -e "MYSQL_ROOT_PASSWORD=testpw" \
    -v jms_mysql:/var/lib/mysql mysql:5.7.23

登录 mysql 创建数据库

docker exec -it jms_mysql mysql -uroot -ptestpw
mysql> CREATE DATABASE `jumpserver` CHARACTER SET utf8;
mysql> GRANT ALL PRIVILEGES ON `jumpserver`.* TO 'jms'@'172.17.%' IDENTIFIED BY "jumpserver";
mysql> FLUSH PRIVILEGES;

创建 jumpserver 镜像

git clone https://github.com/Tiantiandas/jumpserver.git
cd jumpserver
docker build -t xxx/jumpserver<:tag> .

也可以从 dockerhub 获取

docker pull zhegao/jumpserver

运行 jumpserver 容器

docker run -d --name jms_server \
    -p 8080:80 \
    -p 2222:2222 \
    --link jms_mysql:mysql \
    -e "DB_HOST=jms_mysql" \
    -e "DB_USER=<mysql_user>" \
    -e "DB_PASSWORD=<mysql_password>" \
    -e "DB_NAME=<mysql_dbname>" \
    -e "DB_PORT=<mysql_port>" \
    zhegao/jumpserver

宿主机 nginx 配置

因为 coco 是 websocket 服务, 需要指定 Upgrade Header 以及 http_version.

upstream jumpserver{
    server 127.0.0.1:8080;
}
server {
    listen 80;
    server_name  _;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwared-Proto "http";
    location / {
        proxy_pass http://jumpserver;
    }
    location /media/ {
        add_header Content-Encoding gzip;
        proxy_pass http://jumpserver;
    }
    location /socket.io/ {
        proxy_pass       http://jumpserver;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
    error_page 404 /404.html;
        location = /40x.html {
    }
    error_page 500 502 503 504 /50x.html;
        location = /50x.html {
    }
}

SSL 证书生成

[ letsencrypt ]

使用 mkcert 生成证书

# centos
yum -y install golang nss-tools
# ubuntu
apt-get install golang libnss3-tools
git clone https://github.com/FiloSottile/mkcert.git
cd mkcert && make 
mv bin/mkcert /bin

mkcert install

具体使用可使用: mkcert --help