我有两个 rails 应用程序,它们都在同一台 Ubuntu 16.04 机器上使用单独的和实例。一个当前位于域中POSTGRES
,另一个应该位于同一域的子域中。nginx
puma
它们的nginx
配置将位于单独的文件中,以便自动部署。
第一个 Rails 服务器已经上线根网站)一段时间,并根据使用 Letsencrypt 的 HSTS在根域 ( example.com
) 上。第二个 rails 应用程序应该运行在子域 ( news.example.com
) 上,并且也将使用 Letsencrypt 在 HSTS 下提供服务。
以下是我的实时域的 nginx 配置:
根域
upstream puma_bubblin_production {
server unix:/var/www/bubblin.io/shared/tmp/sockets/puma.sock fail_timeout=0;
}
server {
listen 80;
listen [::]:80 ipv6only=on;
server_name bubblin.io www.bubblin.io;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name www.bubblin.io;
ssl_certificate /etc/letsencrypt/live/www.bubblin.io/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/www.bubblin.io/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
rewrite ^ https://bubblin.io$request_uri permanent;
}
server {
server_name bubblin.io;
root /var/www/bubblin.io/current/public;
try_files $uri/index.html $uri @puma_bubblin_production;
client_max_body_size 4G;
keepalive_timeout 10;
error_page 500 502 504 /500.html;
error_page 503 @503;
location @puma_bubblin_production {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_redirect off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header X-Forwarded-Proto http;
proxy_pass http://puma_bubblin_production;
# limit_req zone=one;
access_log /var/www/bubblin.io/shared/log/nginx.access.log;
error_log /var/www/bubblin.io/shared/log/nginx.error.log;
}
location ^~ /assets/ {
gzip_static on;
expires max;
add_header Cache-Control public;
}
location = /50x.html {
root html;
}
location = /404.html {
root html;
}
location @503 {
error_page 405 = /system/maintenance.html;
if (-f $document_root/system/maintenance.html) {
rewrite ^(.*)$ /system/maintenance.html break;
}
rewrite ^(.*)$ /503.html break;
}
if ($request_method !~ ^(GET|HEAD|PUT|PATCH|POST|DELETE|OPTIONS)$ ){
return 405;
}
if (-f $document_root/system/maintenance.html) {
return 503;
}
listen 443 ssl http2; # managed by Certbot
listen [::]:443 ssl http2;
ssl_certificate /etc/letsencrypt/live/bubblin.io/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/bubblin.io/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
# Add HSTS header with preloads
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
}
子域名
这不起作用。
upstream puma_news_bubblin_io {
server unix:/var/www/news/shared/tmp/sockets/puma.sock fail_timeout=0;
}
server {
listen 80;
listen [::]:80;
server_name news.bubblin.io;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl_certificate /etc/letsencrypt/live/news.bubblin.io/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/news.bubblin.io/privkey.pem; # managed by Certbot
rewrite ^ https://news.bubblin.io$request_uri permanent;
}
server {
server_name news.bubblin.io;
root /var/www/news/current/public;
try_files $uri/index.html $uri @puma_news_bubblin_io;
client_max_body_size 4G;
keepalive_timeout 10;
error_page 500 502 504 /500.html;
error_page 503 @503;
location @puma_news_bubblin_io {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_redirect off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header X-Forwarded-Proto http;
proxy_pass http://puma_news_bubblin_io;
# proxy_pass http://localhost:3030;
# limit_req zone=one;
access_log /var/www/news/shared/log/nginx.access.log;
error_log /var/www/news/shared/log/nginx.error.log;
}
location ^~ /assets/ {
gzip_static on;
expires max;
add_header Cache-Control public;
}
location = /50x.html {
root html;
}
location = /404.html {
root html;
}
location @503 {
error_page 405 = /system/maintenance.html;
if (-f $document_root/system/maintenance.html) {
rewrite ^(.*)$ /system/maintenance.html break;
}
rewrite ^(.*)$ /503.html break;
}
if ($request_method !~ ^(GET|HEAD|PUT|PATCH|POST|DELETE|OPTIONS)$ ){
return 405;
}
if (-f $document_root/system/maintenance.html) {
return 503;
}
listen 443 ssl http2; # managed by Certbot
listen [::]:443 ssl http2;
ssl_certificate /etc/letsencrypt/live/news.bubblin.io/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/news.bubblin.io/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
# Add HSTS header with preloads
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
}
nginx.conf
上述两个配置均按照以下子句纳入:
include /etc/nginx/sites-enabled/*;
我该怎么做?
答案1
您的网站 news.bubblin.io 正在使用用于测试的证书。证书链实际上是:
Certificate chain
0 s:CN = news.bubblin.io
i:CN = Fake LE Intermediate X1
1 s:CN = Fake LE Intermediate X1
i:CN = Fake LE Root X1
您的主站点 www.bubblin.io 使用了正确的 Let's Encrypt 证书链。
Certificate chain
0 s:CN = www.bubblin.io
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
i:O = Digital Signature Trust Co., CN = DST Root CA X3
重新生成您的证书,但这次不要使用诸如--staging
或 之类的选项--test
,因为这些选项会导致创建假证书。