Configuring nginx to proxy thin and Rails ActionCable - ruby-on-rails

Question

I'm experimenting with ActionCable (mostly replicating the DHH example) and trying to get it to run on an Ubuntu server with thin (on port 8443) and nginx. It all works fine locally but, when I try to proxy it on a live server I get this error response: failed: Error during WebSocket handshake: Unexpected response code: 301.
Here's my the relevant bits of my nginx configuration:
server {
listen 80;
server_name _not_;
root /home/ubuntu/www/;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
upstream websocket {
server 127.0.0.1:8443;
}
server {
listen 80;
...
location /websocket/ {
proxy_pass http://127.0.0.1:8443;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_redirect off;
}
...
}
I'm sort of out of my league with nginx here -- what am I missing or getting wrong?

Answer 1

I came back to this after a month and discovered that the issues were not with the nginx configuration but related to thin. I did three things:
(1) Configured thin to use the Faye adapter:
# config.ru
require 'faye'
Faye::WebSocket.load_adapter('thin')
require ::File.expand_path('../config/environment', __FILE__)
use Faye::RackAdapter, mount: '/faye', timeout: 25
run Rails.application
(2) Switched to mounting ActionCable in routes.rb, rather than trying to run it as a standalone.
#routes.rb
MyAwesomeApp::Application.routes.draw do
...
match "/websocket", to: ActionCable.server, via: [:get, :post]
end
(3) Returned to my normal nginx configuration, the websockets upstreaming thin (as the webserver does:
map $http_upgrade $connection_upgrade {
default upgrade;
'' close; }
upstream thin {
server 127.0.0.1:3000;
}
server {
...
location /websocket {
proxy_pass http://thin;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade; }
...
}
So, my apologies nginx, I'm exonerating you -- seems the issues were primarily related to thin.
Edit: I've added the old nginx configuration I had returned to after mounting in the routes. Also worth noting, for those using SSL is that config.force_ssl will break the secure wss websocket. Instead, you should do force_ssl on the controller level, as recommended here, and configure nginx to rewrite any HTTP routes to HTTPS.

Answer 2

This thread was very helpful to me, but I elected to separate the AC process into a separate puma instance so I could configure workers, etc separately. I later added SSL proxying from nginx to ensure the latest ciphers, etc are used. This avoids rails/puma/AC having to worry about SSL vs non-SSL; everything is non-SSL inside the server instance.
Here's my server section for AC:
server {
listen 881 ssl;
ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
server_name localhost;
location / {
proxy_pass http://cable;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
Note from this github issue: you need to ensure your AC config allows your domain as a source:
#config/initializers/cable.rb
ActionCable.server.config.allowed_request_origins = %w( http://my-domain.com )