{"id":1621,"date":"2025-06-04T16:19:23","date_gmt":"2025-06-04T08:19:23","guid":{"rendered":"http:\/\/www.liujh168.com\/?p=1621"},"modified":"2025-06-04T16:19:23","modified_gmt":"2025-06-04T08:19:23","slug":"wp_tls","status":"publish","type":"post","link":"https:\/\/www.liujh168.com\/index.php\/2025\/06\/04\/wp_tls\/","title":{"rendered":"\u5982\u4f55\u5bf9Docker\u90e8\u7f72\u7684WordPress\u7f51\u7ad9\u8fdb\u884cTLS\u6539\u9020"},"content":{"rendered":"\n

Docker\u90e8\u7f72\u7684WordPress\u7f51\u7ad9TLS\u6539\u9020\u8be6\u7ec6\u6b65\u9aa4<\/h3>\n\n\n\n

\u6838\u5fc3\u539f\u7406<\/strong><\/h4>\n\n\n\n

\u901a\u8fc7Nginx\u53cd\u5411\u4ee3\u7406\u5b9e\u73b0TLS\u7ec8\u6b62\uff0c\u5c06HTTPS\u6d41\u91cf\u89e3\u5bc6\u540e\u8f6c\u53d1\u7ed9WordPress\u5bb9\u5668\uff0c\u540c\u65f6\u4f7f\u7528Let’s Encrypt\u81ea\u52a8\u7ba1\u7406\u8bc1\u4e66\u3002<\/p>\n\n\n\n\n\n\n\n

1. \u51c6\u5907Docker Compose\u6587\u4ef6<\/strong><\/h4>\n\n\n\n

\u539f\u7406<\/strong>\uff1a\u6dfb\u52a0Nginx\u548cCertbot\u5bb9\u5668\uff0cNginx\u5904\u7406HTTPS\u6d41\u91cf\uff0cCertbot\u81ea\u52a8\u7533\u8bf7\/\u7eed\u671f\u8bc1\u4e66\u3002<\/p>\n\n\n\n

# docker-compose.yml<\/em>\nversion: '3.8'\n\nservices:\n  # \u539f\u6709WordPress\u670d\u52a1\uff08\u79fb\u9664\u7aef\u53e3\u6620\u5c04\uff09<\/em>\n  wordpress:\n    image: wordpress:latest\n    environment:\n      WORDPRESS_DB_HOST: db\n      WORDPRESS_DB_USER: exampleuser\n      WORDPRESS_DB_PASSWORD: examplepass\n    volumes:\n      - wordpress:\/var\/www\/html\n    networks:\n      - app-network\n\n  # \u539f\u6709\u6570\u636e\u5e93\u670d\u52a1\uff08\u4fdd\u6301\u4e0d\u53d8\uff09<\/em>\n  db:\n    image: mysql:5.7\n    environment:\n      MYSQL_ROOT_PASSWORD: rootpass\n      MYSQL_DATABASE: wordpress\n      MYSQL_USER: exampleuser\n      MYSQL_PASSWORD: examplepass\n    volumes:\n      - db:\/var\/lib\/mysql\n    networks:\n      - app-network\n\n  # \u65b0\u589eNginx\u670d\u52a1<\/em>\n  nginx:\n    image: nginx:alpine\n    ports:\n      - \"80:80\"\n      - \"443:443\"\n    volumes:\n      - .\/nginx\/conf.d:\/etc\/nginx\/conf.d  # Nginx\u914d\u7f6e<\/em>\n      - .\/certbot\/www:\/var\/www\/certbot:ro # Certbot\u9a8c\u8bc1\u6587\u4ef6<\/em>\n      - .\/certbot\/conf:\/etc\/letsencrypt   # \u8bc1\u4e66\u5b58\u50a8<\/em>\n    networks:\n      - app-network\n    depends_on:\n      - wordpress\n\n  # \u65b0\u589eCertbot\u670d\u52a1\uff08\u8bc1\u4e66\u7ba1\u7406\uff09<\/em>\n  certbot:\n    image: certbot\/certbot\n    volumes:\n      - .\/certbot\/www:\/var\/www\/certbot\n      - .\/certbot\/conf:\/etc\/letsencrypt\n    entrypoint: \"\/bin\/sh -c 'trap exit TERM; while :; do sleep 6h & wait $${!}; certbot renew; done;'\"\n    networks:\n      - app-network\n\nvolumes:\n  wordpress:\n  db:\n\nnetworks:\n  app-network:\n    driver: bridge<\/pre>\n\n\n\n
2. \u914d\u7f6eNginx\u53cd\u5411\u4ee3\u7406<\/strong><\/h4>\n\n\n\n
\u539f\u7406<\/strong>\uff1aNginx\u76d1\u542c443\u7aef\u53e3\uff0c\u4f7f\u7528TLS\u8bc1\u4e66\u89e3\u5bc6\u6d41\u91cf\uff0c\u5e76\u8f6c\u53d1HTTP\u8bf7\u6c42\u5230WordPress\u5bb9\u5668\u3002<\/p>\n\n\n\n
    \n
  1. \u521b\u5efaNginx\u914d\u7f6e\u76ee\u5f55\uff1abash\u590d\u5236\u4e0b\u8f7dmkdir -p nginx\/conf.d<\/li>\n\n\n\n
  2. \u521b\u5efa\u914d\u7f6e\u6587\u4ef6 nginx\/conf.d\/wordpress.conf<\/code>\uff1anginx\u590d\u5236\u4e0b\u8f7dserver { listen 80; server_name yourdomain.com; # \u66ff\u6362\u4e3a\u4f60\u7684\u57df\u540d<\/em> location \/.well-known\/acme-challenge\/ { root \/var\/www\/certbot; # Certbot\u9a8c\u8bc1\u76ee\u5f55<\/em> } location \/ { return 301 https:\/\/$host$request_uri; # HTTP\u91cd\u5b9a\u5411\u5230HTTPS<\/em> } } server { listen 443 ssl; server_name yourdomain.com; # TLS\u8bc1\u4e66\u8def\u5f84\uff08\u7531Certbot\u751f\u6210\uff09<\/em> ssl_certificate \/etc\/letsencrypt\/live\/yourdomain.com\/fullchain.pem; ssl_certificate_key \/etc\/letsencrypt\/live\/yourdomain.com\/privkey.pem; # \u5b89\u5168\u534f\u8bae\u914d\u7f6e<\/em> ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; location \/ { proxy_pass http:\/\/wordpress:80; # \u8f6c\u53d1\u5230WordPress\u5bb9\u5668<\/em> proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # \u544a\u77e5WordPress\u4f7f\u7528HTTPS<\/em> } }<\/li>\n<\/ol>\n\n\n\n
    3. \u9996\u6b21\u7533\u8bf7TLS\u8bc1\u4e66<\/strong><\/h4>\n\n\n\n
    \u539f\u7406<\/strong>\uff1aCertbot\u901a\u8fc7HTTP-01\u6311\u6218\u9a8c\u8bc1\u57df\u540d\u6240\u6709\u6743\uff0c\u751f\u6210\u8bc1\u4e66\u5e76\u5b58\u50a8\u5728\u5171\u4eab\u76ee\u5f55\u3002<\/p>\n\n\n\n
      \n
    1. \u542f\u52a8Nginx\uff08\u9700\u5148\u5f00\u653e80\u7aef\u53e3\uff09\uff1abash\u590d\u5236\u4e0b\u8f7ddocker-compose up -d nginx<\/li>\n\n\n\n
    2. \u8fd0\u884cCertbot\u7533\u8bf7\u8bc1\u4e66\uff1abash\u590d\u5236\u4e0b\u8f7ddocker-compose run –rm certbot certonly \\ –webroot -w \/var\/www\/certbot \\ –email your@email.com –agree-tos –no-eff-email \\ -d yourdomain.com # \u66ff\u6362\u4e3a\u4f60\u7684\u57df\u540d<\/em><\/li>\n\n\n\n
    3. \u9a8c\u8bc1\u8bc1\u4e66\u751f\u6210\uff1abash\u590d\u5236\u4e0b\u8f7dls .\/certbot\/conf\/live\/yourdomain.com\/ # \u5e94\u770b\u5230fullchain.pem\u548cprivkey.pem<\/em><\/li>\n<\/ol>\n\n\n\n
      4. \u91cd\u542fNginx\u5e76\u542f\u7528HTTPS<\/strong><\/h4>\n\n\n\n
        \n
      1. \u91cd\u542fNginx\u52a0\u8f7d\u8bc1\u4e66\uff1abash\u590d\u5236\u4e0b\u8f7ddocker-compose restart nginx<\/li>\n\n\n\n
      2. \u5f3a\u5236WordPress\u4f7f\u7528HTTPS\uff1a\n