Docker 官方容器镜像仓库https://hub.docker.com/search部署 jenkinsdocker run 命令sudo mkdir-p/opt/jenkins_home# Jenkins 容器默认使用用户 ID 1000sudo chown-R 1000:1000/opt/jenkins_home docker run-d--name jenkins--restartalways-p 8080:8080-p 50000:50000-v/opt/jenkins_home:/var/jenkins_home jenkins/jenkins:2.541.1-lts部署gitlabdocker run 命令docker run-d--name gitlab-p 180:80-p 143:443-p 122:22--restart always-v/opt/gitlab/config:/etc/gitlab-v/opt/gitlab/logs:/var/log/gitlab-v/opt/gitlab/data:/var/opt/gitlab gitlab/gitlab-ce:18.8.1-ce.0部署nexus3docker run 命令sudo mkdir-p/opt/nexus3 sudo chown-R 200:200/opt/nexus3 docker run-d--name nexus3-p 8081:8081--restart always-v/opt/nexus3:/nexus-datasonatype/nexus3:3.87.2部署nginx先把nginx需要的配置文件从nginx容器cp到本地mkdir-p/opt/nginx/conf/ docker run-d--name nginx_tmp nginx:1.28.1-alpine-slim# 注意 nginx/. 有个点 这样就只 cp nginx目录下的配置文件dockercpnginx_tmp:/etc/nginx/./opt/nginx/conf/ dockerrm-f nginx_tmpdocker run 命令docker run-d--name nginx-p 80:80-p 443:443--restart always-v/opt/nginx/conf:/etc/nginx:ro-v/opt/nginx/logs:/var/log/nginx nginx:1.28.1-alpine-slimjenkins为列 配置 80 端口转发到对应的 容器 8080 端口我用 cloudflare 进行测试 做域名解析把下面的配置文件复制到 jenkins.confvim/opt/nginx/conf/conf.d/jenkins.confserver{listen 80;# jenkinss.relatedyuan.dpdns.org 这个是绑定的域名 需要解析到对应的服务器公网IPserver_name jenkinss.relatedyuan.dpdns.org;client_max_body_size 4096m;access_log/var/log/nginx/jenkins_access.log;location/{# 10.0.2.15:8080 IP是主机的内网IP 端口是容器暴露的 8080 端口proxy_pass http://10.0.2.15:8080;# 核心代理头proxy_set_header Host$host;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto$scheme;# WebSocket支持proxy_http_version 1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connectionupgrade;# 超时设置proxy_connect_timeout 60s;proxy_send_timeout 60s;proxy_read_timeout 60s;# 防止请求重复proxy_next_upstream off;}}重启nginx生效docker restart nginx因为不是 https 所有会提示不安全jenkins为列 配置 443 端口转发到对应的 容器 8080 端口代理状态 开启 已代理SSL 当前加密模式 : 完全在 cloudflare 上配置 源服务器 创建证书注意证书创建后 无法在查看 需要提前保存mkdir-p/opt/nginx/conf/ssl/jenkinss.relatedyuan.dpdns.org# 把上面的证书放在下面的两个文件里面vim/opt/nginx/conf/ssl/jenkinss.relatedyuan.dpdns.org/fullchain.pem vim/opt/nginx/conf/ssl/jenkinss.relatedyuan.dpdns.org/privkey.pem把下面的配置文件复制到 jenkins.confvim/opt/nginx/conf/conf.d/jenkins.confserver{# HTTPS 监听listen 443 ssl;server_name jenkinss.relatedyuan.dpdns.org;# SSL 证书配置 ssl_certificate/etc/nginx/ssl/jenkinss.relatedyuan.dpdns.org/fullchain.pem;ssl_certificate_key/etc/nginx/ssl/jenkinss.relatedyuan.dpdns.org/privkey.pem;# SSL 优化配置 ssl_protocols TLSv1.2 TLSv1.3;ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;ssl_prefer_server_ciphers on;# SSL 会话缓存ssl_session_cache shared:SSL:10m;ssl_session_timeout 10m;ssl_session_tickets off;# 启用 OCSP Stapling提升性能ssl_stapling on;ssl_stapling_verify on;# 安全头部 add_header Strict-Transport-Securitymax-age63072000; includeSubDomains; preloadalways;add_header X-Frame-Options DENY always;add_header X-Content-Type-Options nosniff always;add_header X-XSS-Protection1; modeblockalways;add_header Referrer-Policystrict-origin-when-cross-originalways;client_max_body_size 4096m;access_log/var/log/nginx/jenkins_access.log;location/{proxy_pass http://10.0.2.15:8080;# 核心代理头proxy_set_header Host$host;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto https;proxy_set_header X-Forwarded-Ssl on;# WebSocket支持proxy_http_version 1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connectionupgrade;# 超时设置proxy_connect_timeout 60s;proxy_send_timeout 60s;proxy_read_timeout 60s;# 防止请求重复proxy_next_upstream off;}}重启nginx生效docker restart nginx查看证书过期时间 下面命令两个域名都需要替换echo|openssl s_client-servername jenkinss.relatedyuan.dpdns.org-connect jenkinss.relatedyuan.dpdns.org:443 2/dev/null|openssl x509-noout-dates手动生成新的域名证书 (记录 文档并未使用)certbot certonly-d jenkinss.relatedyuan.dpdns.org--manual--preferred-challenges dns证书续期 (记录 文档并未使用)certbot renew--cert-name jenkinss.relatedyuan.dpdns.org--manual--preferred-challenges dns