7

I'm having difficulty deploying my meteor app ("myApp" below) into production using meteor-up with https and NGINX as a proxy. In particular, I think I am having trouble configuring the correct ports and/or paths.

The deployment has worked in most respects. It is running on a digital ocean droplet with a mongohq (now compose.io) database. My mup setup, mup reconfig (run now many times on my mup.json file) and mup deploy commands with meteor-up all report no errors. If I ssh into my ubuntu environment on digital ocean and run status myApp it reports myApp start/running, process 10049, and when I check my mongohq database, I can see the expected collections for myApp were created and seeded. I think on this basis that the app is running properly.

My problem is that I cannot locate it visiting the site, and having no experience with NGINX servers, I cannot tell if I am doing something very basic and wrong setting up the ports and forwarding.

I have reproduced the relevant parts of my NGINX config file and mup.json file below.

The behavior I expected with the setup below is that if my meteor app listens on port 3000 in mup.json the app should appear when I visit the site. In fact, if I set mup.json's env.PORT to 3000, when visiting the site my browser tells me there is a redirect loop. If I change mup's env.PORT to 80, or leave the env.PORT out entirely, I receive a 502 Bad Gateway message - this part is to be expected because myApp should be listening on localhost:3000 and I wouldn't expect to find anything anywhere else.

All help is MUCH appreciated.

MUP.JSON (in relevant part, lmk if more needs to be shown)

"env": {
  "PORT": 3000,
  "NODE_ENV": "production",
  "ROOT_URL": "http://myApp.com",
  "MONGO_URL": // working ok, not reproduced here,
  "MONGO_OPLOG_URL": // working ok I think,
  "MAIL_URL": // working ok
}

NGINX

server_tokens off;

# according to a digital ocean guide i followed here, https://www.digitalocean.com/community/tutorials/how-to-deploy-a-meteor-js-application-on-ubuntu-14-04-with-nginx, this section is needed to proxy web-socket connections

map $http_upgrade $connection_upgrade {
      default upgrade;
      ''      close;
}

# HTTP

server {
      listen 80 default_server;
      listen [::]:80 default_server ipv6only=on;
      server_name myApp.com;
      # redirect non-SSL to SSL
      location / {
              rewrite ^ https://$server_name$request_uri? permanent;
      }
}

# HTTPS

server {
      listen 443 ssl spdy;

      # this domain must match Common Name (CN) in the SSL certificate

      server_name myApp.com;

      root html;
      index index.html index.htm;

      ssl_certificate /etc/nginx/ssl/tempcert.crt;
      ssl_certificate_key /etc/nginx/ssl/tempcert.key;

      ssl_stapling on;
      ssl_session_cache shared:SSL:10m;
      ssl_session_timeout 5m;

      ssl_prefer_server_ciphers on;
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers 'long string I didn't reproduce here'

      add_header Strict-Transport-Security "max-age=31536000;";

      location / {
              proxy_pass http://localhost:3000;
              proxy_http_version 1.1;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection "upgrade";
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
      }
}

Also note that the SSL certificates are configured and work fine so I think it is something with how the ports, paths and forwarding is configured. I don't know where the redirect loop is coming from.

4

4 回答 4

12

对于将来遇到此问题的任何人，我都可以通过force-ssl从捆绑的流星应用程序中删除包来解决问题。显然 force-ssl 和 NGINX 代理要么是多余的，要么如果一起使用会导致过多的重定向。这在我能找到的材料中没有得到很好的记录。

如果有一个配置支持将 force-ssl 与代理一起使用，该代理具有某种目的并且比完全删除包更可取，请发布，因为我有兴趣知道。谢谢。

于 2014-11-14T22:00:43.243 回答
5

我相信只要将 X-Forward-Proto 标头添加到 Nginx 配置中，您就可以保留 force-ssl 包。

例子：

 proxy_set_header X-Forward-Proto https;

此外，请确保您也设置了 X-Forward-For ，尽管您发布的示例中已经有。

资源

于 2015-01-28T20:06:22.163 回答
1

正如force-ssl 包的文档所述，您必须将x-forwarded-proto标头设置为 https ：

因此，您在 nginx 配置中的位置字段将如下所示：

location / {
          #your own config...
          proxy_set_header X-Forwarded-Proto https;
  }
于 2016-12-24T08:51:22.973 回答
0

我在 NGinx 代理后面运行流星。安装 force-ssl 后，我收到有关重定向过多的错误。

删除 force-ssl 然后将以下行添加到我的 nginx 配置中的位置的方法：

proxy_set_header X-Forward-Proto https;
proxy_set_header X-Nginx-Proxy true;

现在完美运行。

于 2016-02-06T21:59:28.000 回答