# Help with ssl config nginx -\> thin -\> rails

**URL:** <https://www.ruby-forum.com/t/help-with-ssl-config-nginx-thin-rails/215690>\
**Category:** NGINX\
**Created:** [January 12, 2012, 7:31pm UTC](https://www.ruby-forum.com/t/help-with-ssl-config-nginx-thin-rails/215690 "2012-01-12T19:31:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [January 12, 2012, 7:31pm UTC](https://www.ruby-forum.com/t/help-with-ssl-config-nginx-thin-rails/215690/1 "2012-01-12T19:31:23Z")

</div>

I’m lost in a sea of configurations and every change I make ends up  
causing  
a different problem in relation to serving over HTTPS. I’ve tried all  
kinds  
of different combos of the headers. I’m using nginx in front of thin web  
servers for rails.

With the below config, serving static content works. Serving rails pages  
now just bombs over HTTPS with a 400. The prior config I had caused an  
endless redirect.

Being a relative newbie to nginx and rails, my guess is that it has  
something to do with the thin servers serving over the 400x ports, but  
the  
upstream below just referencing 443. How should this be configured to  
serve  
dynamic rails content over SSL when you have 20 nodes on thin started?

Thanks for any help!

upstream developmentmode{  
server 127.0.0.1:4000;  
server 127.0.0.1:4001;  
server 127.0.0.1:4002;  
server 127.0.0.1:4003;  
server 127.0.0.1:4004;  
server 127.0.0.1:4005;  
server 127.0.0.1:4006;  
server 127.0.0.1:4007;  
server 127.0.0.1:4008;  
server 127.0.0.1:4009;  
server 127.0.0.1:4010;  
server 127.0.0.1:4011;  
server 127.0.0.1:4012;  
server 127.0.0.1:4013;  
server 127.0.0.1:4014;  
server 127.0.0.1:4015;  
server 127.0.0.1:4016;  
server 127.0.0.1:4017;  
server 127.0.0.1:4018;  
server 127.0.0.1:4019;  
}

upstream devmode-secure{  
server 127.0.0.1:443;  
}

server {  
listen 80;  
server\_name [govenga.com](http://govenga.com) [www.govenga.com](http://www.govenga.com);  
server\_name 50.56.121.244;  
access\_log /var/www/dev/log/access.log;  
error\_log /var/www/dev/log/error.log;

```
    client_max_body_size 50M;
    client_body_buffer_size 512k;

    root /var/www/dev/public/;
    index index.html;
    location ~*

```

^.+.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|txt|tar|mid|midi|wav|bmp|rtf|ttf|woff|svg|eot)$  
{  
root /var/www/dev/public/;  
expires 10y;  
add\_header Cache-Control public;  
}  
location ~ ^(/javascripts/.\*)$ {  
root /var/www/dev/public/;  
expires 10y;  
add\_header Cache-Control public;  
}  
location / {  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Host $host:$proxy\_port;  
proxy\_redirect off;

if (-f $request\_filename/index.html) {  
rewrite (._) $1/index.html break;  
}  
if (-f $request\_filename.html) {  
rewrite (._) $1.html break;  
}  
if (!-f $request\_filename) {  
proxy\_pass [http://developmentmode](http://developmentmode);  
break;  
}  
}  
}  
server {  
listen 443;  
server\_name [govenga.com](http://govenga.com) [www.govenga.com](http://www.govenga.com);  
ssl on;  
ssl\_certificate /etc/nginx/certificates/new/govenga.com.crt;  
ssl\_certificate\_key  
/etc/nginx/certificates/new/govenga\_new.key;  
ssl\_client\_certificate /etc/nginx/certificates/new/gd\_bundle.crt;  
keepalive\_timeout 70;

# 

```
    access_log /var/www/dev/log/access.log;
    error_log /var/www/dev/log/error.log;

```

# 

```
    client_max_body_size 50M;
    client_body_buffer_size 512k;

```

# 

```
    root /var/www/dev/public/;
    index index.html;
    location ~*

```

^.+.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|txt|tar|mid|midi|wav|bmp|rtf|ttf|woff|svg|eot)$  
{  
root /var/www/dev/public/;  
expires 1y;  
add\_header Cache-Control public;  
}  
location / {  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Host $http\_host;  
proxy\_set\_header X-Forwarded-Proto https;  
proxy\_redirect off;  
proxy\_set\_header X-Url-Scheme $scheme;

```
  if (-f $request_filename/index.html) {
    rewrite (.*) $1/index.html break;
  }
  if (-f $request_filename.html) {
    rewrite (.*) $1.html break;
  }
  if (!-f $request_filename) {
    proxy_pass https://devmode-secure;
    break;
  }
}

```

}

---

<div class="post-metadata">

**Author:** ![karl\_j](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/77aa72/32.png) [@karl\_j](https://www.ruby-forum.com/u/karl_j)\
**Post date:** [January 12, 2012, 11:30pm UTC](https://www.ruby-forum.com/t/help-with-ssl-config-nginx-thin-rails/215690/2 "2012-01-12T23:30:31Z")

</div>

On Thursday 12 January 2012 22:30:43 Karl J. wrote:  
[…]

> ```
> }
> 
> ```

Why did you put regexp captures everywhere and don’t use them?

> ```
> }
> 
> ```

It’s ugly. Please read:

> **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)**
>
> ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com

> **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)**
>
> ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com

..and use the “try\_files” directive:

> **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#try_files)**
>
> This directive appeared in version 1.11.8.

[…]

> }  
> }  
> server {  
> listen 443;  
> server\_name [govenga.com](http://govenga.com) [www.govenga.com](http://www.govenga.com);  
> […]  
> proxy\_pass [https://devmode-secure](https://devmode-secure);  
> […]

and above:

> upstream devmode-secure{  
> server 127.0.0.1:443;  
> }

…looks like you set up a loopback proxy pass to nginx itself.

wbr, Valentin V. Bartenev

---

<div class="post-metadata">

**Author:** ![karl\_j](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/77aa72/32.png) [@karl\_j](https://www.ruby-forum.com/u/karl_j)\
**Post date:** [January 13, 2012, 4:43pm UTC](https://www.ruby-forum.com/t/help-with-ssl-config-nginx-thin-rails/215690/3 "2012-01-13T16:43:17Z")

</div>

Ignore all of the regex’s for now, they were left over from a previous  
developer who configured the instance. I’ll remove them.

My biggest concern though is around what the address(s) should be for  
devmode-secure.  
What should that look like in the config if the IP plus 443 causes it to  
loopback to nginx?

Thanks for your help.  
Karl

---

<div class="post-metadata">

**Author:** ![karl\_j](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/77aa72/32.png) [@karl\_j](https://www.ruby-forum.com/u/karl_j)\
**Post date:** [January 13, 2012, 5:43pm UTC](https://www.ruby-forum.com/t/help-with-ssl-config-nginx-thin-rails/215690/4 "2012-01-13T17:43:59Z")

</div>

On Friday 13 January 2012 19:42:42 Karl J. wrote:  
[…]

> My biggest concern though is around what the address(s) should be for  
> devmode-secure.

As usual, address and port that your backend listening.

> What should that look like in the config if the IP plus 443 causes it to  
> loopback to nginx?

What do you want exactly? Use nginx for SSL and proxy https to http  
backend?

Or proxy https to https transparently?

wbr, Valentin V. Bartenev