Nginx loop de redirecionamento ao usar proxy_pass sobre SSL

Question

Estamos usando o Nginx como um balanceador de carga para nosso aplicativo Rails. Como estamos mudando para uma solução de hospedagem multicloud, queremos que nosso balanceador de carga comece a usar SSL em todas as conexões quando estiver encaminhando solicitações para frontends, já que algumas delas podem passar pela Internet.

O problema que estou enfrentando é que a página não https criou um loop de redirecionamento. Isso parece ser causado pelo cabeçalho X-Forwarded-Proto não estar definido corretamente. Então, quando o rails obtém uma requisição no http, ele acha que é uma requisição https, mesmo que não seja, então ele a redireciona para http, e acha que é uma requisição https e assim por diante.

Nenhuma quantidade de Googling parece me ajudar a corrigir esse problema. Então eu gostaria de saber:

• Isso é suportado pelo NGINX (acho que é)
• Há algo errado com minha configuração
• Há algo conceitualmente errado com minha abordagem

Obrigado!

user www-data;
worker_processes  2;

events {
    worker_connections  1024;
    use epoll;
}


http {
    passenger_root /opt/ruby-enterprise/lib/ruby/gems/1.8/gems/passenger-3.0.2;
    passenger_ruby /opt/ruby-enterprise/bin/ruby;
    passenger_pool_idle_time 0;
    passenger_max_pool_size 20;  # Over all apps
    passenger_min_instances 5;   # Over each app
    passenger_use_global_queue on;
    rails_env production;

    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '"$remote_addr", "$remote_user", "$time_local", "$request", '
                      '"$uid_got", "$uid_set", "$status", "$body_bytes_sent", "$http_referer", '
                      '"$http_user_agent", "$http_x_forwarded_for"';

    ## Compression
    gzip on;
    gzip_http_version 1.0;
    gzip_comp_level 2;
    gzip_proxied any;
    gzip_min_length  1100;
    gzip_buffers 16 8k;
    gzip_types text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;
    # Some version of IE 6 don't handle compression well on some mime-types, so just disable for them
    gzip_disable "MSIE [1-6].(?!.*SV1)";
    # Set a vary header so downstream proxies don't send cached gzipped content to IE6
    gzip_vary on;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;

    client_max_body_size 20M;

    server {
           listen    80 default;
       return        404;
    }

    server {
           listen        80;
           server_name   MYDOMAIN.com;
           rewrite ^(.*) http://www.MYDOMAIN.com$1 permanent;
    }

    server {
           listen 80;
           server_name www.MYDOMAIN.com;
           root        /u/apps/MYDOMAIN_marketing/current/public;

           passenger_enabled on;

           userid on;
           userid_domain MYDOMAIN.com;
           userid_expires max;

           access_log /u/apps/MYDOMAIN_marketing/shared/log/nginx/access.log main;
           error_log  /u/apps/MYDOMAIN_marketing/shared/log/nginx/error.log info;
    }

    #####################

    upstream app_backend {
           server www01:8000;
           server www02:8000;
           server www03:8000;
           server www04:8000;
           server www05:8000;
           server www06:8000;
    }

    server {
           listen 80;
           server_name *.MYDOMAIN.com;
           root /u/apps/MYDOMAIN/current/public;

           userid on;
           userid_domain MYDOMAIN.com;
           userid_expires max;

           access_log /u/apps/MYDOMAIN/shared/log/nginx/lb_access.log main;
           error_log  /u/apps/MYDOMAIN/shared/log/nginx/lb_error.log info;

           if (-f $document_root/system/maintenance.html) {
                    # I don't know how to get NGINX to both show a page and give a return code.
                    # So just return 503 with a generic error page.
                    return 503;
           }

           location / {
                    ## General Rails error page stuff
                    error_page 404              /404.html;
                    error_page 422              /422.html;
                    error_page 500 502 503 504  /500.html;
                    error_page 403              /403.html;

            # If the file exists then stop here. Saves 4 more stats and some
            # rewrites.
            if (-f $request_filename) { 
                  break; 
                }

                    # Rails page caching
                    if (-f $request_filename/index.html) {
                          rewrite (.*) $1/index.html break;
                    }

                    if (-f $request_filename.html) {
                          rewrite (.*) $1.html break;
                    }

                    # If it hasn't been handled above, and isn't a static file
                    # then send to passenger.
                    proxy_pass https://app_backend;
                    proxy_connect_timeout 1;
                    ##proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header Host $http_host;
                    proxy_set_header X-Forwarded-Proto http;
           }
    }

    server {
           ssl on;
           listen 8000;
           server_name *.MYDOMAIN.com;
           root /u/apps/MYDOMAIN/current/public;

           passenger_enabled on;

           access_log /u/apps/MYDOMAIN/shared/log/nginx/access.log main;
           error_log  /u/apps/MYDOMAIN/shared/log/nginx/error.log info;
    }

    ########################

    # SSL configuration from:                                                         
    # http://tumblelog.jauderho.com/post/121851623/nginx-and-stronger-ssl
    # http://articles.slicehost.com/2007/12/19/ubuntu-gutsy-nginx-ssl-and-vhosts
    ssl_certificate      MYDOMAIN.com.combined.crt;
    ssl_certificate_key  MYDOMAIN.com.key;
    ssl_prefer_server_ciphers on;
    ssl_protocols        SSLv3 TLSv1;
    ssl_session_cache    shared:SSL:2m;
    ssl_ciphers          ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;

    # This is necessary to catch random crap thrown at us during the
    # SecurityMetrics scans before it hits Passenger.  Without this,
    # Passenger becomes confused and stops serving requests.

    server {
           listen 443 default;
       ssl on;
       return 404;
    }

    server {
           # If we're willing to log secure and non-secure together,
           # we can probably just merge this with the config above.

           listen 443;
       server_name *.MYDOMAIN.com;
       ssl on;

           root /u/apps/MYDOMAIN/current/public;

           userid on;
           userid_domain MYDOMAIN.com;
           userid_expires max;

           access_log /u/apps/MYDOMAIN/shared/log/nginx/lb_secure_access.log main;
           error_log  /u/apps/MYDOMAIN/shared/log/nginx/lb_secure_error.log info;

           if (-f $document_root/system/maintenance.html) {
                    # I don't know how to get NGINX to both show a page and give a return code.
                    # So just return 503 with a generic error page.
                    return 503;
           }

           location / {
                    ## General Rails error page stuff
                    error_page 404              /404.html;
                    error_page 422              /422.html;
                    error_page 500 502 503 504  /500.html;
                    error_page 403              /403.html;

            # If the file exists then stop here. Saves 4 more stats and some
            # rewrites.
            if (-f $request_filename) { 
                  break; 
                }

                    # Rails page caching
                    if (-f $request_filename/index.html) {
                          rewrite (.*) $1/index.html break;
                    }

                    if (-f $request_filename.html) {
                          rewrite (.*) $1.html break;
                    }

                    # If it hasn't been handled above, and isn't a static file
                    # then send to passenger.
                    proxy_pass https://app_backend;
                    proxy_connect_timeout 1;
                    ##proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header Host $http_host;
                    proxy_set_header X-Forwarded-Proto https;
           }
    }
}

    

Answer 1

Acontece que Passenger e Nginx não funcionam como a maioria dos outros. Você precisa forçar manualmente o cabeçalho HTTPS em seu arquivo nginx.conf.

server {
  listen 8000;
  ssl on;
  server_name *.pagerduty.com *.supportduty.com;
  root /u/apps/pagerduty/current/public;

  set $my_https "off";
  if ($http_x_forwarded_proto = "https") {
      set $my_https "on";
  }

  passenger_enabled on;
  passenger_set_cgi_param HTTPS $my_https;

  access_log /u/apps/pagerduty/shared/log/nginx/access.log main;
  error_log  /u/apps/pagerduty/shared/log/nginx/error.log info;
}

    

Answer 2

As declarações if podem não definir os cabeçalhos de proxy corretamente.

Veja: link - > "A diretiva tem problemas quando usada no contexto de localização, em alguns casos não faz o que você espera, mas algo completamente diferente."

As declarações if podem ser substituídas por declarações try_files , o que é mais eficiente.

Seu arquivo conf deve ter esta aparência:

server {
    listen 80;
    server_name *.MYDOMAIN.com;
    root /u/apps/MYDOMAIN/current/public;

    userid on;
    userid_domain MYDOMAIN.com;
    userid_expires max;

    access_log /u/apps/MYDOMAIN/shared/log/nginx/lb_access.log main;
    error_log  /u/apps/MYDOMAIN/shared/log/nginx/lb_error.log info;

    location $document_root/system/maintenance.html {
        return 503;
    }

    # Nginx will try thoses locations and will stop after the first success
    try_files $uri $uri.html $uri/index.html @passenger

    location / {
        ## General Rails error page stuff
        error_page 404         /404.html;
        error_page 422         /422.html;
        error_page 500 502 503 504  /500.html;
        error_page 403         /403.html;
    }

    location @passenger {
    # Here you're sure that if the request goes to the backends, the header will be set. If this doesn't work, then you should consider charging the ruby app.
        proxy_pass https://app_backend;
        proxy_connect_timeout 1;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto http;
    }
}