# Securring a rails app deployed with passenger

**URL:** <https://www.ruby-forum.com/t/securring-a-rails-app-deployed-with-passenger/136697>\
**Category:** Deployment\
**Created:** [May 5, 2008, 5:35pm UTC](https://www.ruby-forum.com/t/securring-a-rails-app-deployed-with-passenger/136697 "2008-05-05T17:35:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rasmus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/7993a0/32.png) [@rasmus](https://www.ruby-forum.com/u/rasmus)\
**Post date:** [May 5, 2008, 5:35pm UTC](https://www.ruby-forum.com/t/securring-a-rails-app-deployed-with-passenger/136697/1 "2008-05-05T17:35:51Z")

</div>

Hi guys,

I want my rails app to be accessible from certain IPs only. I tried to  
archieve this the way I was used to it in the PHP-world (in apache  
vhost-setup):

\<VirtualHost \*:80\>  
ServerName [my.domain.com](http://my.domain.com)  
DocumentRoot /home/todo/public  
RailsEnv production  
  
deny from all  
#allow from 1.1.1.1 #ip1  
#allow from 2.2.2.2 #ip2

All static files (css, js and so on) are prohibited for unknown IP as  
they should, but [my.domain.com/](http://my.domain.com/) is not! Rails just servers the HTML to  
all visitors.

What can I do to restrict my site certain IPs?

Thanks!

---

<div class="post-metadata">

**Author:** ![rasmus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/7993a0/32.png) [@rasmus](https://www.ruby-forum.com/u/rasmus)\
**Post date:** [May 6, 2008, 12:01pm UTC](https://www.ruby-forum.com/t/securring-a-rails-app-deployed-with-passenger/136697/2 "2008-05-06T12:01:35Z")

</div>

I’m not an apache expert but I’m pretty sure that   
directive should say \<Directory /home/todo/public\>

On May 6, 1:35 am, Rasmus N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![rasmus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/7993a0/32.png) [@rasmus](https://www.ruby-forum.com/u/rasmus)\
**Post date:** [May 6, 2008, 1:14pm UTC](https://www.ruby-forum.com/t/securring-a-rails-app-deployed-with-passenger/136697/3 "2008-05-06T13:14:31Z")

</div>

You must write allow directive into Proxy definition too.  
Put your absolute path into Directory definition (as said Ivan).

Regards!  
Rasmus N. escribió:

> ```
> <Directory />
> 
> ```
> 
> What can I do to restrict my site certain IPs?
> 
> Thanks!

–  
Rafael Garcia Ortega

---

<div class="post-metadata">

**Author:** ![rasmus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/7993a0/32.png) [@rasmus](https://www.ruby-forum.com/u/rasmus)\
**Post date:** [May 6, 2008, 4:58pm UTC](https://www.ruby-forum.com/t/securring-a-rails-app-deployed-with-passenger/136697/4 "2008-05-06T16:58:40Z")

</div>

On Mon, 2008-05-05 at 17:35 +0200, Rasmus N. wrote:

> All static files (css, js and so on) are prohibited for unknown IP as  
> they should, but [my.domain.com/](http://my.domain.com/) is not! Rails just servers the HTML to  
> all visitors.
> 
> What can I do to restrict my site certain IPs?

Hi Rasmus,

That Directory section should be a Location section. This is necessary  
with the normal Apache proxying too as Apache isn’t technically  
accessing that directory, your Rails app is.

John.

–  
[http://www.brightbox.co.uk](http://www.brightbox.co.uk) - UK Ruby on Rails hosting