1 安装脚本

  1. #! /bin/sh
  2. docker run --name jms_all -d \
  3.   --restart always \
  4.   -v /data/jumpserver/data:/opt/jumpserver/data \
  5.   -p 9991:80 \
  6.   -p 9992:8080 \
  7.   -p 9993:8081 \
  8.   -p 9994:8070 \
  9.   -p 9995:5000 \
  10.   -p 2222:2222 \
  11.   -e SECRET_KEY=RQjr4c9TmjFhb0GAZaiss0zYBPkLfBKbOTbr6TZyXWJk0aZ1zC \
  12.   -e BOOTSTRAP_TOKEN=SAlyB1ZIkxAJRnbf \
  13.   -e DB_HOST=180.163.53.44 \  #不能用127.0.0.1，跟内部地址有冲突
  14.   -e DB_PORT=3360 \
  15.   -e DB_USER=jumpserver \
  16.   -e DB_PASSWORD=Jumpserver_12 \
  17.   -e DB_NAME=jumpserver \
  18.   -e REDIS_HOST=180.163.53.44 \ #不能用127.0.0.1，跟内部地址有冲突
  19.   -e REDIS_PORT=6380 \
  20.   -e REDIS_PASSWORD=Redis_12 \
  21.   --privileged=true \
  22.   jumpserver/jms_all:latest

2 nginx 配置

官方用容器安装后，直接暴露80和2222端口，在服务器用nginx转发后，有些服务不能使用，所以把里面的端口都暴露出来直接的转发，参考下面

  1. server {
  2.     listen 443 ssl;
  3.     server_name jserver.baoflag.com;
  5.     client_max_body_size 2200m;
  6.     access_log /data/logs/logs-nginx/jserver.baoflag.com_access.log;
  7.     error_log /data/logs/logs-nginx/jserver.baoflag.com_error.log;
  9.     ssl_certificate   /etc/nginx/keys/baoflag.com.pem;
  10.     ssl_certificate_key  /etc/nginx/keys/baoflag.com.key;
  11.     ssl_session_timeout 5m;
  12.     ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
  13.     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  14.     ssl_prefer_server_ciphers on;
  16.     #error_page 497  https://$host$uri?$args; 
  17.     location /koko/ {
  18.         proxy_pass       http://localhost:9995;
  19.         proxy_buffering off;
  20.         proxy_http_version 1.1;
  21.         proxy_set_header Upgrade $http_upgrade;
  22.         proxy_set_header Connection "upgrade";
  23.         proxy_set_header X-Real-IP $remote_addr;
  24.         proxy_set_header Host $host;
  25.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  26.         access_log off;
  27.     }
  29.     location /guacamole/ {
  30.         proxy_pass       http://localhost:9993/;
  31.         proxy_buffering off;
  32.         proxy_http_version 1.1;
  33.         proxy_set_header Upgrade $http_upgrade;
  34.         proxy_set_header Connection $http_connection;
  35.         proxy_set_header X-Real-IP $remote_addr;
  36.         proxy_set_header Host $host;
  37.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  38.         access_log off;
  39.     }
  41.     location /ws/ {
  42.         proxy_set_header X-Real-IP $remote_addr;
  43.         proxy_set_header Host $host;
  44.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  45.         proxy_pass http://localhost:9994;
  46.         proxy_http_version 1.1;
  47.         proxy_buffering off;
  48.         proxy_set_header Upgrade $http_upgrade;
  49.         proxy_set_header Connection "upgrade";
  50.     }
  52.     location /api/ {
  53.         proxy_pass http://localhost:9992;
  54.         proxy_set_header X-Real-IP $remote_addr;
  55.         proxy_set_header Host $host;
  56.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  57.     }
  59.     location /core/ {
  60.         proxy_pass http://localhost:9992;
  61.         proxy_set_header X-Real-IP $remote_addr;
  62.         proxy_set_header Host $host;
  63.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  64.     }
  66.   #  location / {
  67.   #      rewrite ^/(.*)$ /ui/$1 last;
  68.   #  }
  69.     location / {
  70.       proxy_pass http://127.0.0.1:9991/;
  71.       proxy_set_header Host $http_host;
  72.       proxy_set_header X-Real-IP $remote_addr;
  73.       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  74.       proxy_set_header X-Forwarded-Proto $scheme;
  75.       proxy_buffering off;
  76.       proxy_request_buffering off;
  77.     }
  78.  }
  79. server {
  80.     listen 80;
  81.     server_name jserver.baoflag.com;
  82.     rewrite ^(.*)$ https://$host$1 permanent;
  83. }

官方网站
https://docs.jumpserver.org/zh/master/