193 lines
4.2 KiB
Markdown
193 lines
4.2 KiB
Markdown
# Authentik Traefik 代理配置指南
|
||
|
||
## 配置概述
|
||
|
||
已为Authentik配置Traefik代理，实现SSL证书自动管理和域名访问。
|
||
|
||
## 配置详情
|
||
|
||
### Authentik服务信息
|
||
- **容器IP**: 192.168.31.144
|
||
- **HTTP端口**: 9000 (可选)
|
||
- **HTTPS端口**: 9443 (主要)
|
||
- **容器状态**: 运行正常
|
||
- **SSH认证**: 已配置密钥认证，无需密码
|
||
|
||
### Traefik代理配置
|
||
|
||
#### 服务配置
|
||
```yaml
|
||
authentik-cluster:
|
||
loadBalancer:
|
||
servers:
|
||
- url: "https://192.168.31.144:9443" # Authentik容器HTTPS端口
|
||
serversTransport: authentik-insecure
|
||
healthCheck:
|
||
path: "/flows/-/default/authentication/"
|
||
interval: "30s"
|
||
timeout: "15s"
|
||
```
|
||
|
||
#### 路由配置
|
||
```yaml
|
||
authentik-ui:
|
||
rule: "Host(`authentik.git-4ta.live`)"
|
||
service: authentik-cluster
|
||
entryPoints:
|
||
- websecure
|
||
tls:
|
||
certResolver: cloudflare
|
||
```
|
||
|
||
## DNS配置要求
|
||
|
||
需要在Cloudflare中为以下域名添加DNS记录：
|
||
|
||
### A记录
|
||
```
|
||
authentik.git-4ta.live A <hcp1的Tailscale IP>
|
||
```
|
||
|
||
### 获取hcp1的Tailscale IP
|
||
```bash
|
||
# 方法1: 通过Tailscale命令
|
||
tailscale ip -4 hcp1
|
||
|
||
# 方法2: 通过ping
|
||
ping hcp1.tailnet-68f9.ts.net
|
||
```
|
||
|
||
## 部署步骤
|
||
|
||
### 1. 更新Traefik配置
|
||
```bash
|
||
# 重新部署Traefik job
|
||
nomad job run components/traefik/jobs/traefik-cloudflare-git4ta-live.nomad
|
||
```
|
||
|
||
### 2. 配置DNS记录
|
||
在Cloudflare Dashboard中添加A记录：
|
||
- **Name**: authentik
|
||
- **Type**: A
|
||
- **Content**: <hcp1的Tailscale IP>
|
||
- **TTL**: Auto
|
||
|
||
### 3. 验证SSL证书
|
||
```bash
|
||
# 检查证书是否自动生成
|
||
curl -I https://authentik.git-4ta.live
|
||
|
||
# 预期返回200状态码和有效的SSL证书
|
||
```
|
||
|
||
### 4. 测试访问
|
||
```bash
|
||
# 访问Authentik Web UI
|
||
open https://authentik.git-4ta.live
|
||
|
||
# 或使用curl测试
|
||
curl -k https://authentik.git-4ta.live
|
||
```
|
||
|
||
## 健康检查
|
||
|
||
### Authentik健康检查端点
|
||
- **路径**: `/if/flow/default-authentication-flow/`
|
||
- **间隔**: 30秒
|
||
- **超时**: 15秒
|
||
|
||
### 检查服务状态
|
||
```bash
|
||
# 检查Traefik路由状态
|
||
curl -s http://hcp1.tailnet-68f9.ts.net:8080/api/http/routers | jq '.[] | select(.name=="authentik-ui")'
|
||
|
||
# 检查服务健康状态
|
||
curl -s http://hcp1.tailnet-68f9.ts.net:8080/api/http/services | jq '.[] | select(.name=="authentik-cluster")'
|
||
```
|
||
|
||
## 故障排除
|
||
|
||
### 常见问题
|
||
|
||
1. **DNS解析问题**
|
||
```bash
|
||
# 检查DNS解析
|
||
nslookup authentik.git-4ta.live
|
||
|
||
# 检查Cloudflare DNS
|
||
dig @1.1.1.1 authentik.git-4ta.live
|
||
```
|
||
|
||
2. **SSL证书问题**
|
||
```bash
|
||
# 检查证书状态
|
||
openssl s_client -connect authentik.git-4ta.live:443 -servername authentik.git-4ta.live
|
||
|
||
# 检查Traefik证书存储
|
||
ls -la /opt/traefik/certs/
|
||
```
|
||
|
||
3. **服务连接问题**
|
||
```bash
|
||
# 检查Authentik容器状态
|
||
sshpass -p "Aa313131@ben" ssh -o StrictHostKeyChecking=no root@pve "pct exec 113 -- netstat -tlnp | grep 9000"
|
||
|
||
# 检查Traefik日志
|
||
nomad logs -f traefik-cloudflare-v1
|
||
```
|
||
|
||
### 调试命令
|
||
|
||
```bash
|
||
# 检查Traefik配置
|
||
curl -s http://hcp1.tailnet-68f9.ts.net:8080/api/rawdata | jq '.routers[] | select(.name=="authentik-ui")'
|
||
|
||
# 检查服务发现
|
||
curl -s http://hcp1.tailnet-68f9.ts.net:8080/api/rawdata | jq '.services[] | select(.name=="authentik-cluster")'
|
||
|
||
# 检查中间件
|
||
curl -s http://hcp1.tailnet-68f9.ts.net:8080/api/rawdata | jq '.middlewares'
|
||
```
|
||
|
||
## 下一步
|
||
|
||
配置完成后，可以：
|
||
|
||
1. **配置OAuth2 Provider**
|
||
- 在Authentik中创建OAuth2应用
|
||
- 配置回调URL
|
||
- 设置客户端凭据
|
||
|
||
2. **集成HCP服务**
|
||
- 为Nomad UI配置OAuth2认证
|
||
- 为Consul UI配置OAuth2认证
|
||
- 为Vault配置OIDC认证
|
||
|
||
3. **用户管理**
|
||
- 创建用户组和权限
|
||
- 配置多因素认证
|
||
- 设置访问策略
|
||
|
||
## 安全注意事项
|
||
|
||
1. **网络安全**
|
||
- Authentik容器使用内网IP (192.168.31.144)
|
||
- 通过Traefik代理访问，不直接暴露
|
||
|
||
2. **SSL/TLS**
|
||
- 使用Cloudflare自动SSL证书
|
||
- 强制HTTPS重定向
|
||
- 支持现代TLS协议
|
||
|
||
3. **访问控制**
|
||
- 建议配置IP白名单
|
||
- 启用多因素认证
|
||
- 定期轮换密钥
|
||
|
||
---
|
||
|
||
**配置完成时间**: $(date)
|
||
**配置文件**: `/root/mgmt/components/traefik/jobs/traefik-cloudflare-git4ta-live.nomad`
|
||
**域名**: `authentik.git-4ta.live`
|
||
**状态**: 待部署和测试
|