Docker如何搭建HALO-Blog

1、安装docker，采用docker部署。

#先卸载所有有冲突的软件包
[root@bing-blog ~]# yum remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate  docker-engine
[root@bing-blog ~]# yum install -y yum-utils device-mapper-persistent-data lvm2
[root@bing-blog ~]# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
#安装最新版本
[root@bing-blog ~]# yum install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
[root@bing-blog ~]# yum install -y docker
#启动docker
[root@bing-blog ~]# sudo systemctl start docker && sudo systemctl enable docker

2、创建Halo容器

[root@bing-blog ~]# docker run -it -d --name halo -p 8090:8090 -v ~/.halo2:/root/.halo2 -e JVM_OPTS="-Xmx256m -Xms256m" registry.fit2cloud.com/halo/halo:2.20
注：此命令默认使用自带H2 Database数据库，若需使用 PostgreSQL 请自行搭建。

docker命令参数详解：

• -it 开启输入功能并连接终端
• -d 后台运行容器
• --name 为容器指定一个名称
• -p 端口映射
• -v 工作目录映射

3、使用nginx做反向代理

#建立nginx配置文件目录/日志文件目录/ssl证书文件目录
[root@bing-blog ~]# mkdir -p /data/nginx/
[root@bing-blog ~]# mkdir -p /data/nginx/logs
[root@bing-blog ~]# mkdir -p /data/nginx/ssl

#nginx.conf配置文件
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 2048;
    multi_accept on;
    use epoll;
}

http {
    # 上游服务必须定义在 http 模块内部
    upstream backend {
        server 后端IP:端口 max_fails=3 fail_timeout=30s;
    }

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    keepalive_requests 1000;
    client_max_body_size 100M;

    log_format security '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for" '
                       'RequestTime=$request_time UpstreamTime=$upstream_response_time';
    access_log  /var/log/nginx/access.log  security;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1h;

    server {
        listen 443 ssl;
        server_name 域名;

        ssl_certificate      /etc/nginx/ssl/域名.pem;
        ssl_certificate_key  /etc/nginx/ssl/域名.key;

        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "SAMEORIGIN";

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            gzip_static on; # 静态压缩
            add_header Cache-Control public,max-age=60,s-maxage=60; # 配置缓存
            proxy_set_header HOST $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

    }
    server {
        listen 80;
        server_name 域名;
        return 301 https://$server_name$request_uri;
    }
}

4、在阿里云申请免费ssl证书，并配置DNS解析，把证书密钥文件下载并上传到nginx的ssl文件下,即可.



5、docker容器创建nginx。

#docker会自动拉取镜像最新的nginx并启动容器
[root@bing-blog ~]# docker run -d --name nginx -p 80:80 -p 443:443 -v /data/nginx/nginx.conf:/etc/nginx/nginx.conf:ro -v /data/nginx/ssl:/etc/nginx/ssl -v /data/nginx/logs:/var/log/nginx  nginx:latest

6、使用域名访问完成博客部署。