Deploying Meteor for Production with Meteor-Up, SSL, and NGINX

Question

I'm having difficulty deploying my meteor application ("myApp" below) into production using meteor-up with https and NGINX as a proxy server. In particular, I think I'm having trouble setting up the correct ports and / or paths.

In most cases, deployment works. It runs on a digital ocean drop using the mongohq database (now compose.io). My mup setup , mup reconfig (now executed many times in my mup.json file) and mup deploy with meteor-up all do not report any errors. If I ssh into my ubuntu environment in the digital ocean and run the status myApp , it tells myApp start/running, process 10049 , and when I check my mongohq database, I see that the expected collections for myApp were created and seeded. I think, on this basis, the application is working correctly.

My problem is that I can’t find it on the site and having no experience with NGINX servers, I can’t say if I am doing something very simple and incorrect port creation and forwarding.

I reproduced the corresponding parts of the NGINX configuration file and the mup.json file below.

The behavior that I expected when setting up below is that if my meteor application listens on port 3000 in mup.json, the application should appear when I enter the site. In fact, if I set mup.json env.PORT to 3000, when I visit the site, my browser tells me that there is a redirect cycle. If I change mup env.PORT to 80 or completely leave env.PORT, I get a 502 Bad Gateway message - this part should be expected because myApp should listen on localhost: 3000, and I would not expect to find anywhere else.

All help is greatly appreciated.

MUP.JSON (in the corresponding part, lmk, if you need to show more)

 "env": { "PORT": 3000, "NODE_ENV": "production", "ROOT_URL": "http://myApp.com", "MONGO_URL": // working ok, not reproduced here, "MONGO_OPLOG_URL": // working ok I think, "MAIL_URL": // working ok } 

Nginx

 server_tokens off; # according to a digital ocean guide i followed here, https://www.digitalocean.com/community/tutorials/how-to-deploy-a-meteor-js-application-on-ubuntu-14-04-with-nginx, this section is needed to proxy web-socket connections map $http_upgrade $connection_upgrade { default upgrade; '' close; } # HTTP server { listen 80 default_server; listen [::]:80 default_server ipv6only=on; server_name myApp.com; # redirect non-SSL to SSL location / { rewrite ^ https://$server_name$request_uri? permanent; } } # HTTPS server { listen 443 ssl spdy; # this domain must match Common Name (CN) in the SSL certificate server_name myApp.com; root html; index index.html index.htm; ssl_certificate /etc/nginx/ssl/tempcert.crt; ssl_certificate_key /etc/nginx/ssl/tempcert.key; ssl_stapling on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 5m; ssl_prefer_server_ciphers on; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers 'long string I didn't reproduce here' add_header Strict-Transport-Security "max-age=31536000;"; location / { proxy_pass http://localhost:3000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } } 

Also note that SSL certificates are configured and working fine, so I think this is how ports, paths, and forwarding are configured. I don’t know where the call forwarding comes from.

Answer 1

For those who came across this in the future, I was able to solve everything by removing the force-ssl package from my related meteor application. Apparently force-ssl and the NGINX proxy are either redundant or used together can cause too many redirects. This was poorly documented in the materials I could find.

If there is a configuration that supports the use of force-ssl together with a proxy server that serves some purpose and is most preferable to remove the package, send a message as I would be interested to know. Thank you

Answer 2

I believe that you can save the force-ssl package while you add the X-Forward-Proto header to your Nginx configuration.

Example:

  proxy_set_header X-Forward-Proto https; 

In addition, make sure that you also have X-Forward-For installed, although this is already in the example above.

A source

Answer 3

As stated in the force-ssl package documentation, you should set the x-forwarded-proto header to https:

So your location field in nginx configuration will look like this:

 location / { #your own config... proxy_set_header X-Forwarded-Proto https; } 

Answer 4

I run a meteor behind the NGinx proxy. I got an error about too many redirects after installing force-ssl.

What worked to remove force-ssl and then add the following lines to my location in my nginx configuration:

 proxy_set_header X-Forward-Proto https; proxy_set_header X-Nginx-Proxy true; 

Now works fine.