После небольшой попытки настроить AWS Route53 IPv6 и мой DSN (Ionos) мне удалось настроить SSL в моем приложении для блога Django, работающем с Gunicorn и nginx.
Я использовал этот учебник
К сожалению, сначала это натолкнулось на ошибку цикла перенаправления, которую мне удалось исправить, но теперь это 502 Bad Gateway, и когда я проверяю логи, похоже, что работники Gunicorn всегда истекают. Я попытался установить тайм-аут на 300 с для nginx и Gunicorn, но это просто означает более длительное ожидание ошибки 502. Больше ничего не меняется.
Вот лог:
Mar 21 23:13:46 ip-172-31-35-104 systemd[1]: Started A high performance web server and a reverse proxy server.
-- Subject: Unit nginx.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit nginx.service has finished starting up.
--
-- The start-up result is done.
Mar 21 23:13:46 ip-172-31-35-104 sudo[2107]: pam_unix(sudo:session): session closed for user root
Mar 21 23:14:19 ip-172-31-35-104 gunicorn[2055]: [2019-03-21 23:14:19 +0000] [2055] [CRITICAL] WORKER TIMEOUT (pid:2061)
Mar 21 23:14:19 ip-172-31-35-104 gunicorn[2055]: [2019-03-21 23:14:19 +0000] [2061] [INFO] Worker exiting (pid: 2061)
Mar 21 23:14:19 ip-172-31-35-104 gunicorn[2055]: base dir path /home/ubuntu/puchalatravel/puchalatravel
Mar 21 23:14:19 ip-172-31-35-104 gunicorn[2055]: [2019-03-21 23:14:19 +0000] [2125] [INFO] Booting worker with pid: 2125
Настройка nginx:
server {
listen 80;
listen [::]:80;
server_name puchalatravel.com www.puchalatravel.com;
return 404; # managed by Certbot
return 301 https://puchalatravel.com$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name puchalatravel.com;
ssl on;
ssl_certificate /etc/letsencrypt/live/puchalatravel.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/puchalatravel.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; #managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; #managed by Certbot
location /static {
root /home/ubuntu/puchalatravel/;
}
location /media {
root /home/ubuntu/puchalatravel/;
}
location /.well-known {
root /var/www/common/letsencrypt/;
}
location / {
# include proxy_params;
proxy_redirect off;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 60s;
proxy_read_timeout 120s;
}
}
Настройка Gunicorn:
[Unit]
Description=gunicorn daemon
After=network.target
[Service]
User=ubuntu
Group=www-data
WorkingDirectory=/home/ubuntu/puchalatravel
ExecStart=/home/ubuntu/puchalatravel/puchalatravelenv/bin/gunicorn --access-logfile - --timeout 30 --workers 3 --bind unix:/home/ubuntu/puchalatravel/puchalatravel.sock puchalatravel.wsgi:application
[Install]
WantedBy=multi-user.target
В код Django не было внесено никаких изменений, за исключением добавления следующих строк в settings.py:
.
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
Весь код можно найти здесь: GitHub repo
Адрес веб-сайта: puchalatravel.com
Есть идеи, что может быть источником проблемы?
EDIT. Похоже, проблема с SSL, журнал ошибок nginx:
2019/03/22 07:15:24 [error] 2123#2123: *83 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 83.6.170.100, server: puchalatravel.com, request: "GET / HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/", host: "puchal$2019/03/22 07:15:56 [error] 2123#2123: *85 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 83.6.170.100, server: puchalatravel.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/favic$2019/03/22 07:36:35 [error] 2123#2123: *94 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET / HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/", host: "puc$2019/03/22 07:37:06 [error] 2123#2123: *94 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/fa$2019/03/22 07:40:58 [error] 2123#2123: *100 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET / HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/", host: "pu$2019/03/22 07:41:29 [error] 2123#2123: *100 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/f$2019/03/22 07:44:22 [error] 12508#12508: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET / HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/", host: "pu$2019/03/22 07:44:52 [error] 12508#12508: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/f$2019/03/22 07:53:57 [error] 12508#12508: *4 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET / HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/", host: "pu$2019/03/22 07:54:10 [notice] 12698#12698: signal process started
2019/03/22 07:54:24 [notice] 12700#12700: signal process started
2019/03/22 07:54:27 [notice] 12703#12703: signal process started
2019/03/22 07:54:28 [error] 12508#12508: *4 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/f$2019/03/22 07:58:51 [error] 12704#12704: *27 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 5.255.250.163, server: puchalatravel.com, request: "GET /robots.txt HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/rob$2019/03/22 07:59:22 [error] 12704#12704: *30 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 141.8.143.160, server: puchalatravel.com, request: "GET /robots.txt HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/rob$2019/03/22 07:59:53 [error] 12704#12704: *32 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 178.154.246.138, server: puchalatravel.com, request: "GET /posts/ HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/posts$2019/03/22 08:03:10 [error] 12813#12813: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET / HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/", host: "pu$2019/03/22 08:03:41 [error] 12813#12813: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/f$2019/03/22 08:37:39 [error] 12813#12813: *18 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET / HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/", host: "p$2019/03/22 08:56:08 [error] 13024#13024: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET / HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/", host: "pu$2019/03/22 08:56:39 [error] 13024#13024: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 213.229.174.164, server: puchalatravel.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://unix:/home/ubuntu/puchalatravel/puchalatravel.sock:/f$