I’ve EC2 Ubuntu 18.04 Server with Python Flask framework running on Gunicorn application server with Nginx reverse proxy listening on port 80 & 443. I’ve added LetsEncrypt for the domain using certbot.
The website works fine without ssl. With LetsEncrypt ssl configuration on Nginx the server fails to load the page. My previous supervisor and Nginx configuration without ssl support is as follows and Nginx works with gunicorn with no issues.
server {
listen 80;
server_name example.com www.example.com;
location /static {
alias /home/ubuntu/myapp-backend/myapp/static;
}
location / {
proxy_pass http://localhost:8000;
include /etc/nginx/proxy_params;
proxy_redirect off;
}
}
When I change the Nginx configuration to include LetsEncrypt support while listening on port 80 & 443, the website doesn’t show up… It shows indefinite 301 redirects requests.
server {
listen 80;
server_name example.com www.example.com;
return 301 https://www.example.com$request_uri;
}
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
return 301 https://www.example.com$request_uri;
}
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
location /static {
alias /home/ubuntu/myapp-backend/myapp/static;
}
location / {
proxy_pass http://localhost:8000;
include /etc/nginx/proxy_params;
proxy_redirect off;
}
}
When I load the site example.com , it redirects to https:\\www.example.com . However the website homepage doesn’t load or show any response from server/Nginx. When I login to the server and run curl -v localhost:8000 , the the gunicorn works fine.
curl -v localhost:8000
* Rebuilt URL to: localhost:8000/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8000 (#0)
> GET / HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 500 INTERNAL SERVER ERROR
< Server: gunicorn/19.9.0
< Date: Sat, 28 Sep 2019 14:14:47 GMT
< Connection: close
< Content-Type: text/html; charset=utf-8
< Content-Length: 27911
<
<!doctype html>
...
There was earlier Stackoverflow question on gunicorn over ssl with ssl parameters which can be added to supervisor config. I believe the error must be with on Nginx configuration on port 443 or Gunicornsupervisor config info. If you could have a look, I would appreciate it.
Obscuring your domain is a bit of a problem because your description of the symptoms doesn't match how the nginx config is written. Makes it hard to help you.
Thanks @_az for the reply. Basically its simple flask app with gunicorn server and Nginx reverse proxy with all the installation done using apt-get install command.
I’ve kept all the default settings in Nginx. Only changes added are ‘/etc/nginx/sites-enabled/myapp’ and /etc/supervisor/conf.d/myapp.conf as described above.
Here is the curl response you’ve requested. It currently shows Cloudflare Error 521 Web server is down message. In `Cloudflare A Name DNS entry for ‘@’ & ‘www’ points to EC2 public ip address.
So from here you can try figure out why Cloudflare can’t connect to your server, or you can try disable the Cloudflare proxy (the “orange cloud” next to your A records) to try make this simpler to debug.
Thank you for your quick solution. I disabled the Cloudflare proxy (orange cloud). The website is working like a charm. Now it’s directly serving from Gunicorn via Nginx.
I tried to enabled Cloudflare proxy again and run the curl command. It results in forever 301 redirect loop.
The only DNS settings I’ve is two 'A Records for ‘@’ and ‘www’ value pointing at the server public IP address. I’ve enabled development mode in Cloudflare Cache settings. Still, enabling proxy in Cloudflare results in 301 loop.
I’ve changed the SSL/TLS settings in Cloudflare from default flexSSL to Full SSL. Now website is working fine with Cloudflare proxy on and Cloudflare SSL on FullSSL.
Hi @mnordhoff, thanks for the advice. I will sure use “Full (strict)” mode. I really wish if there was some blog/article type resources for this type of information for developers.