ssl passenger nginx rails 4 routing combine wrong port with https - ruby-on-rails-4

I folowed the rails tutorial org tuto and made a web site
Installed passenger, nginx. Works perfectly on prod env on heroku=>
http://klat.herokuapp.com/ (app not finished but still better than nothing)
Here i use the =>
config.force_ssl = true
(only for heroku)
my routes from routes.rb =>
Rails.application.routes.draw do
get 'users/new'
root 'static_pages#home'
get 'help' => 'static_pages#help'
get 'about' => 'static_pages#about'
get 'contact' => 'static_pages#contact'
get 'login' => 'static_pages#login'
get 'signup' => 'users#new'
resources :users
end
~/.bash_profile and ~/.bashrc got
#a generated key
export SECRET_KEY_BASE="my_very_big_generated_key"
export SECRET_TOKEN="my_very_big_generated_key"
I generated with openssl my own certificates
ls ../cert/
server.crt server.csr server.key server.key.org server.pem
And I launch my server with this command in local
passenger start -p 2000 --ssl-certificate ../cert/server.csr --ssl-port 20001 -e production
I passed two days to get to this point but i can't find out why my server starts at
http ://0.0.0.0:2000/
and redirects at
https ://0.0.0.0:2000
and no one page is accessible: error
An error occurred during a connection to 0.0.0.0:2000. SSL received a record that exceeded the maximum permissible length. (Error code: ssl_error_rx_record_too_long)
But in logs we clearly see
App 12832 stdout:
App 12854 stdout:
App 12854 stdout: Started HEAD "/" for 127.0.0.1 at 2015-04-24 18:09:30 +0200
App 12854 stdout: Processing by StaticPagesController#home as HTML
{... rendering homepage wiht _header.erb _footer.erb etc ...}
So i can visit my website non rendered with css at address:
http: //127.0.0.1:2000/
and i still getting those messages from my nginx server
ActionController::RoutingError (No route matches [GET] "/images/rails.png"):
ActionController::RoutingError (No route matches [GET] "/stylesheets/application.css"):
{...and more ...}
I commented in every file in my ruby on rails app all ssl_force
when i uncomment in config/production.rb
config.force_ssl = true
for local use, i get
on
http ://127.0.0.1:2000/ => redirect to https ://127.0.0.1:2000/ and get => (Error code: ssl_error_rx_record_too_long)
http ://127.0.0.1 => unable to locate
https ://127.0.0.1 => unable to locate
http ://127.0.0.1:2000 => unable to locate
http ://127.0.0.1:2001 => unable to locate
https ://127.0.0.1:2000 => unable to locate
https ://127.0.0.1:2001 => unable to locate
Just can't find out why my openssl generated keys don't work, the pages are not rendered with css and other ressources, it's maybe a routing problem...
A little help is much appreciated!
PS: (But please no help such as "use Thin or Puma or another server, i have a constraint to use at choice nginx, lighthttpd or Apache (the obvious answer is nginx for me)")
And to set up my own ssl certification in my own server is a constraint too in my studies

finally
the command i did to start my server without errors is
passenger start --ssl-certificate ../cert/server.crt --ssl-certificate-key ../cert/server.key -e production --ssl
without specifying the ssl port and standart port
i added
gem 'rack-ssl', :require => 'rack/ssl'
to my gem file
and did several bundle install/--deployment etc...
set up in production.rb
config.force_ssl = true
and in application_controller.rb
force_ssl
so my connection is encrypted now as i connect to
https://0.0.0.0:3000/
BUT...
I'm still unhappy with all those configurations because of the presence of the port number in the url
Anyway, it will do for now...

Related

Browser error during django + SSL connection with local server

I have a problem during adding facebook login button to my website at localhost.
I've already add mysite.com to hosts file and installed django-extensions, werkzeug, pyOpenSSL. By running command python manage.py runserver_plus --cert-file cert.crt my own-made sertificate was created. I imported this certificate to Trusted Chrome sertificates but safe connection doesn't establish. When i pass https://example.com:8000/account/login/ I hit an error NET::ERR_CERT_COMMON_NAME_INVALID,
Failed to confirm that this is the server example.com. Its safety certificate refers to *. The server may be configured incorrectly or someone is trying to intercept your data.
Please help me to solve this.

This site can't provide a secure connection ERR_SLL_PROTOCOL ERROR

I have a google appengine project running in localhost. Everything works fine until i go to the 'login' page. When i go there i get the following error:
This site can’t provide a secure connection 127.0.0.1 sent an invalid response.
Try running Windows Network Diagnostics.
ERR_SSL_PROTOCOL_ERROR
the appengine command i use to run the project is dev_appserver.py" --host 127.0.0.1 . This is run pycharm. This only occurs in the 'login' endpoint and no other endpoint.
The console error i get is:
default: "GET /signin HTTP/1.1" 301 -
to connect over HTTPS you need a valid SSL certificate on your server here is you local server as I understand from the message. you can get a certificate for your local server but I don't think it's worth the trouble while working locally. On the other hand when you deploy to Google App Engine, you get SSL certificate automatically and it's managed by Google, that's why your code works without any problem in the deployment.

App not loading: "localhost didn’t send any data. ERR_EMPTY_RESPONSE"

I just spent a week upgrading rails to 4.2.10, and upgraded a whole bunch of gems and such, and now that I've finally convinced rails to run without errors, my app won't actually load.
This page isn’t working
localhost didn’t send any data.
ERR_EMPTY_RESPONSE
I have no idea where to even start trying to debug this.
The development.log file doesn't have any errors. The entire file says:
^[[1m^[[36mAppConfiguration Load (0.5ms)^[[0m ^[[1mSELECT `configurations`.* FROM `configurations` WHERE `configurations`.`type` IN ('AppConfiguration') AND `configurations`.`name` = 'Default configuration' LIMIT 1^[[0m
Cache read: Spree::Config
Dalli::Server#connect memcached:11211
Cache fetch_hit: Spree::Config
Cache read: Spree::Config
Cache fetch_hit: Spree::Config
Cache read: Spree::Config
Cache fetch_hit: Spree::Config
And nothing new is printed when I hit the page.
docker-compose logs -f abc just says:
=> Booting WEBrick
=> Rails 4.2.10 application starting in development on http://localhost:3000
=> Run `rails server -h` for more startup options
=> Ctrl-C to shutdown server
[2018-08-17 14:48:01] INFO WEBrick 1.3.1
[2018-08-17 14:48:01] INFO ruby 2.1.5 (2014-11-13) [x86_64-linux-gnu]
[2018-08-17 14:48:01] INFO WEBrick::HTTPServer#start: pid=18 port=3000
Would my Gemfile be useful? What else would helpful to share?
It's not a local browser issue, because curl responds with (52) Empty reply from server, as well.
In Firefox: The connection to the server was reset while the page was loading.
ETA: Solved by adding -b 0.0.0.0 at the end of bundle exec rails server

NPM Verdaccio - set uplink to own remote server

I just built an NPM Verdaccio private registry server within our local network and I would like configure an UPLINK to our remote NPM Verdaccio server which is hosted at AWS (and also keep the original npmjs registry).
snippet from Verdaccio config.yaml
uplinks:
npmjs:
url: https://registry.npmjs.org/
our-NPM-AWS-server:
url: https://our-NPM-AWS-server.com
based on the documentation (Verdaccio_UPLINK), I have to set the Authentication parameters there, anyhow.
I found the usage of the UPLINKS here - uplink authorization & here - getting an Auth Token , but it is pretty confusing for me because I am not sure what to set as an AUTH method:
auth:
token:
type: bearer | basic,
token: "token",
token_env: true | <get name process.env> `NPM_TOKEN`
I was not able to find any tutorial which would guide me, so I would like to ask for some insight & help - what is necessary to set on the Internal NPM server & also on the remote NPM AWS server.
Configuration:
Internal NPM server
ubuntu 16.04, node v8.11.1, npm v5.8, Verdaccio v.2.7.4, access is controlled by .htpasswd, NPM is accessible on port 80 (listens on http://127.0.0.1:4873)
Remote own NPM server at AWS
ubuntu 14.04, node v6.14.1, npm v3.10.10, Verdaccio v.2.7.4, access is controlled by .htpasswd, NPM is accessible only via 443 from the outside (proxy_http listens on http://127.0.0.1:4873 with an url_prefix: https://our-NPM-AWS-server.com)
Both servers are operating normally (you can log there with your NPM account, push the packages, etc).
thank you very much
EDIT 2018-04-26
The AWS NPM server is registered into Application ELB, which listens on port 443. The AWS NPM server listens on port 443 and is located in private subnet.
I tried to place AWS Verdaccio instance into public subnet and to access it directly without ELB, however it didnt have any affect and the behavior was same.
The config.yaml file of AWS NPM
The UPLINKS part was not changed
packages:
'#*/*':
# scoped packages
access: $all
publish: $authenticated
proxy: npmjs
'**':
# allow all users (including non-authenticated users) to read and
# publish all packages
#
# you can specify usernames/groupnames (depending on your auth plugin)
# and three keywords: "$all", "$anonymous", "$authenticated"
access: $authenticated
# allow all known users to publish packages
# (anyone can register by default, remember?)
publish: $authenticated
# if package is not available locally, proxy requests to 'npmjs' registry
proxy: npmjs
I tried to set
'**':
access: $all
However, it didnt have any effect.
The config.yaml of Internal Verdaccio Server
uplinks:
aws:
url: https://our-NPM-AWS-server.com/
#strictUrlMatch: false
headers:
authorization: "Basic <token_which_I_harvested_from_/.npmrc_file>"
packages:
'#*/*':
# scoped packages
access: $all
publish: $authenticated
proxy: aws
'**':
# allow all users (including non-authenticated users) to read and
# publish all packages
#
# you can specify usernames/groupnames (depending on your auth plugin)
# and three keywords: "$all", "$anonymous", "$authenticated"
access: $all
# allow all known users to publish packages
# (anyone can register by default, remember?)
publish: $authenticated
# if package is not available locally, proxy requests to 'npmjs' registry
proxy: aws
On Internal Verdaccio instance, I tried to get some package from AWS Verdaccio instance
npm pack --verbose verdaccio-bitbucket
and this is log from AWS Verdaccio:
{"name":"verdaccio","hostname":"hostname_our-NPM-AWS-server","pid":8494,"sub":"in",
"level":30,"req":{"method":"GET","url":"/verdaccio-bitbucket",
"headers":{"host":"our-NPM-AWS-server.com","x-forwarded-for"
:"Public_IP_of_Internal_Verdaccio, 10.XXX.XX.XXX","x-forwarded-proto"
:"https","x-forwarded-port":"443","x-amzn-trace-id":
"Root=X-XXXXXX-XXXXXXXXXXXXXXXX","accept":"application/json;",
"accept-encoding":"gzip","user-agent":"npm (verdaccio/2.7.4)",
"via":"1.1 f8d74eab3cc6 (Verdaccio)","authorization":"<Classified>",
"x-forwarded-host":"our-NPM-AWS-server.com",
"x-forwarded-server":"our-NPM-AWS-server.com","connection":"Keep-Alive"},
"remoteAddress":"127.0.0.1","remotePort":42608},"ip":"127.0.0.1",
"msg":"#{ip} requested '#{req.method} #{req.url}'",
"time":"2018-04-26T20:12:38.893Z","v":0}
{"name":"verdaccio","hostname":"hostname_our-NPM-AWS-server","pid":8494,"sub":"in",
"level":35,"request":{"method":"GET","url":"/verdaccio-bitbucket"},
"remoteIP":"Public_IP_of_Internal_Verdaccio, 10.XXX.XX.XXX via
127.0.0.1","**status":403,"error":"unregistered users are not allowed
to access package verdaccio-bitbucket"**,"bytes":
"in":0,"out":180},"msg":"#{status}, user: #{user}(#{remoteIP}),
req: '#{request.method} #{request.url}', error: #{!error}",
"time":"2018-04-26T20:12:38.895Z","v":0}
and this is log from Internal Verdaccio, where the command was ran from:
http --> 200, req: 'GET https://our-NPM-AWS-server.com/verdaccio-bitbucket' (streaming)
http --> 200, req: 'GET https://our-NPM-AWS-server.com/verdaccio-bitbucket', bytes: 0/34578
http <-- 200, user: <npm_account>(127.0.0.1), req: 'GET /verdaccio-bitbucket', bytes: 0/5038
http <-- 500, user: <npm_account>(127.0.0.1), req: 'GET /verdaccio-bitbucket/-/verdaccio-bitbucket-1.0.0.tgz', error: bad uplink status code: 403
http <-- 500, user: <npm_account>(127.0.0.1), req: 'GET /verdaccio-bitbucket/-/verdaccio-bitbucket-1.0.0.tgz', error: bad uplink status code: 403
http <-- 500, user: <npm_account>(127.0.0.1), req: 'GET /verdaccio-bitbucket/-/verdaccio-bitbucket-1.0.0.tgz', error: bad uplink status code: 403
Your configuration is correct but slightly wrong. Let me fix it.
uplinks:
aws:
url: https://our-NPM-AWS-server.com/
#strictUrlMatch: false
headers:
authorization: "Bearer <token_which_I_harvested_from_/.npmrc_file>"
Do not use Basic, it is Bearer verdaccio uses JWT, unfortunately, verdaccio middleware does not accept bearer in lowercase (it does since verdaccio#v3.0.0-beta.7).
For clarification about Basis and JWT. Since version verdaccio#2.3.0 all tokes are generated with JWT library, somehow, for legacy/unit testing reasons we still accept Basis authentification headers, but, all new tokens generated since verdaccio#2.3.0 must use Bearer in headers instead Basis.
There are a couple of issues I will report on Github, minor ones, but still, causes issues like this one.
I hope it helps.

How do you serve ember-cli from https://localhost:4200 in development

For our authentication to work with our ember app we need to serve the app from a secure url. We have a self signed ssl cert.
How do I setup the ember-cli to serve the index.html form a https domain.
Cheers
Also see https://stackoverflow.com/a/30574934/1392763.
If you will always use SSL you can set "ssl": true in the .ember-cli file for your project which will result in the ember serve command using SSL by default without having to pass the command line flag every time.
By default ember-cli will look in an ssl folder in the root of your project for server.key and server.crt files but you can customize that as well with the --ssl-key and --ssl-cert options to provide an alternate path.
If you don't already have a self signed SSL certificate for development you can follow these instructions to easily generate one: https://devcenter.heroku.com/articles/ssl-certificate-self
Example .ember-cli:
{
"disableAnalytics": false,
// Use SSL for development server by default
"ssl": true,
"ssl-key": "path/to/server.key",
"ssl-cert": "path/to/server.crt"
}
EDIT
For googlers, this is no longer true. Use ember-cli --ssl
Thx to xdumaine Jul 12 at 10:08***
emphasized textYou can't directly from ember-cli without putting your hand in the code which I don't recommend :)
If you want to go this way look at: node_modules/ember-cli/lib/tasks/server/express-server.js and may be also into node_modules/ember-cli/lib/tasks/server/livereload-server.js
For those who still want to go through a web server :
However there are other cleaner solutions, for example use nginx as a (reverse) proxy :) or ever serving directly from nginx on the /dist folder :)
Reverse basic example with nginx (didn't tried with ssl but should theoretically work :p) :
server {
listen 443;
server_name *.example.com;
ssl on;
ssl_certificate /path/to/your/certificate.crt;
ssl_certificate_key /path/to/your/key.key;
location / {
proxy_pass http://localhost:4200;
}
}
I said nginx but actually any webserver can do the trick right :)
NaB DO NOT USE ember serve IN PRODUCTION
I use the tunnels gem with pow port-proxying.
Update: more detail
Using a real web server (like the previous answer with nginx) is a great way to go, and is probably more like your production setup. However, I manage a lot of different projects, and am not that interested in managing an nginx configuration file for all of my projects. Pow makes it easy to make a lot of different projects available on port 80 on one development machine.
Pow has two main modes. The primary function is to be a simple server for Rack applications, accessed via a custom local domain such as http://my-application.dev/. This is done by symlinking ~/.pow/my-application to a directory that contains a rack application. However, pow can also proxy requests to a custom local domain to a specified port by creating a file that contains only the port number (such as echo 4200 > ~/.pow/my-application). This makes it easy to develop locally with an actual domain (also, as a side note, subdomains work too, which is really handy; for example, foobar.my-application.dev will also route to my-application).
Tunnels makes it easy to use pow with https.
Setup
# Install pow
curl get.pow.cx | sh
# Set up pow proxy for your ember app
echo 4200 > ~/.pow/my-application
# Start your ember server
ember serve # specify a port here if you used something else for pow proxy
# Check that http://my-application.dev correctly shows your ember app in the browser
# Install tunnels
gem install tunnels # possibly with sudo depending on your ruby setup
# Start tunnels
sudo tunnels
# Now https://my-application.dev should work