AWS 应用程序负载均衡器上的 Websocket + SSL

Question

我在 ElastickBeanstalk 上部署了一个 Django 应用程序。我最近从 Classic -> Application 迁移了负载均衡器，以支持 Websocket（由 Django-channels (~=1.1.8, channels-api==0.4.0)、Redis Elasticache AWS 和达芙妮（~=1.4））。 HTTP、HTTPS 和 Web Socket 协议工作正常。

但我找不到通过安全 SSL 部署 Websocket 的方法。它正在杀死我，它正在阻塞，因为来自浏览器的 HTTPS 连接将切断不安全的 ws:// 对等请求。

这是我的 ALB 配置有没有人作为解决方案？

Answer 1

您应该使用 wss:// 而不是 ws://。并更改有关代理的设置。我刚刚添加了 wsgi.conf.

<VirtualHost *:80>

WSGIPassAuthorization On

WSGIScriptAlias / /opt/python/current/app/config/wsgi.py

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule .* https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]

LoadModule proxy_wstunnel_module /usr/lib/apache2/modules/mod_proxy_wstunnel.so

ProxyPreserveHost On
ProxyRequests Off

ProxyPass "/ws/chat" "ws://**your site**/ws/chat" Keepalive=On
ProxyPassReverse "/ws/chat" "ws://**your site**/ws/chat" Keepalive=On

<Directory /opt/python/current/app/>
  Require all granted
</Directory>

</VirtualHost>

然后它会给你 200 状态连接。 “/ws/chat/”应该替换为您的 websocket url。

在制作此文件之前，您应该检查您的 daphne 服务器是否已打开。问题我经历的是 daemon.config.

的 djangoenv 和 worker

首先，djangoenv 应该在一条线上。这意味着没有换行符。其次，如果你使用 django channel v2，那么它不需要 worker。所以擦掉它。

这是我的 daemon.config（我使用 8001 端口。）：

files:
  "/opt/elasticbeanstalk/hooks/appdeploy/post/run_supervised_daemon.sh":
    mode: "000755"
    owner: root
    group: root
    content: |
      #!/usr/bin/env bash

      # Get django environment variables
      djangoenv=`cat /opt/python/current/env | tr '\n' ',' | sed 's/%/%%/g' | sed 's/export //g' | sed 's/$PATH/%(ENV_PATH)s/g' | sed 's/$PYTHONPATH//g' | sed 's/$LD_LIBRARY_PATH//g'`
      djangoenv=${djangoenv%?}

      # Create daemon configuraiton script
      daemonconf="[program:daphne]
      ; Set full path to channels program if using virtualenv
      command=/opt/python/run/venv/bin/daphne -b 0.0.0.0 -p 8001 config.asgi:application
      directory=/opt/python/current/app
      user=ec2-user
      numprocs=1
      stdout_logfile=/var/log/stdout_daphne.log
      stderr_logfile=/var/log/stderr_daphne.log
      autostart=true
      autorestart=true
      startsecs=10

      ; Need to wait for currently executing tasks to finish at shutdown.
      ; Increase this if you have very long running tasks.
      stopwaitsecs = 600

      ; When resorting to send SIGKILL to the program to terminate it
      ; send SIGKILL to its whole process group instead,
      ; taking care of its children as well.
      killasgroup=true

      ; if rabbitmq is supervised, set its priority higher
      ; so it starts first
      priority=998

      environment=$djangoenv"

      # Create the supervisord conf script
      echo "$daemonconf" | sudo tee /opt/python/etc/daemon.conf

      # Add configuration script to supervisord conf (if not there already)
      if ! grep -Fxq "[include]" /opt/python/etc/supervisord.conf
          then
          echo "[include]" | sudo tee -a /opt/python/etc/supervisord.conf
          echo "files: daemon.conf" | sudo tee -a /opt/python/etc/supervisord.conf
      fi

      # Reread the supervisord config
      sudo /usr/local/bin/supervisorctl -c /opt/python/etc/supervisord.conf reread

      # Update supervisord in cache without restarting all services
      sudo /usr/local/bin/supervisorctl -c /opt/python/etc/supervisord.conf update

      # Start/Restart processes through supervisord
      sudo /usr/local/bin/supervisorctl -c /opt/python/etc/supervisord.conf restart daphne

并仔细检查您的安全组 alb 到 ec2。祝你好运！

Answer 2

我也一直在为 SSL、EBS 和 Channels 1.x 苦苦挣扎，场景与您描述的完全相同，但最终我可以部署我的应用程序。 SSL 一直是个问题，因为 Django 忽略了我在 routing.py 文件中的所有 SSL 请求的路由，并且在此之前一切正常。

我决定将所有 websockets 请求发送到服务器中的唯一根路径，比如 /ws/*。然后向负载均衡器添加特定规则，它通过端口 443 接收所有这些请求，并将它们重定向到端口 5000（Daphne worker 正在监听）作为 HTTP 请求（不是 HTTPS！）。不过，假设在负载均衡器后面，VPC 是足够安全的。请注意，此配置可能涉及其他项目的安全问题。

现在我的负载均衡器配置如下所示

...as HTTPS connection from the browser will cut a non secure ws:// peer requests.

还有一件事。您应该使用 wss:// 通过 HTTPS 启动 websocket 连接。你可以在你的 .js 文件中写这样的东西。

var wsScheme = window.location.protocol.includes('https') ? 'wss' : 'ws';
var wsPath = wsScheme + '://' + window.location.host + '/your/ws/path';
var ws = new ReconnectingWebSocket(wsPath);

祝你好运！

Answer 3

又研究了2天，终于破解了这个配置！

答案如下：

右边，MINIMUM，aws - ALB Config：事实上，我们需要
- 解码 SSL（这不是端到端加密）
- 将所有流量转发到 Daphne。我之所以没有在 web conf 中进行非常广泛的传播：“/ws/*”路由到 Daphne，是因为它确实为我提供了 HandShake OK，但之后，什么都没有，nada，websocket 无法被推回订户。我认为，原因是 Daphne 的回击不尊重您在 conf 中自定义的自定义基础尾随 URL。另外，我不能确定这种解释。但是我可以肯定的是，如果我不将所有流量转发给 Daphne，握手后它就不会工作。
  1. 最低部署配置
- 部署中不需要完整的 .ebextension 覆盖代理：

.ebextensions/05_channels.config

files:
  "/opt/elasticbeanstalk/hooks/appdeploy/post/start_supervisor.sh":
  mode: "000755"
  owner: root
  group: root
  content: |
    #!/usr/bin/env bash
    sudo virtualenv -p /usr/bin/python2.7 /tmp/senv
    source /tmp/senv/bin/activate && source /opt/python/current/env
    sudo python --version > /tmp/version_check.txt
    sudo pip install supervisor

    sudo /usr/local/bin/supervisord -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf
    sudo /usr/local/bin/supervisorctl -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf reread
    sudo /usr/local/bin/supervisorctl -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf update
    sudo /usr/local/bin/supervisorctl -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf restart all
    sudo /usr/local/bin/supervisorctl -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf status

start_daphne.sh（根据我的 ALB 配置，我选择了 8001 端口）

#!/usr/bin/env bash source /opt/python/run/venv/bin/activate && source /opt/python/current/env /opt/python/run/venv/bin/daphne -b 0.0.0.0 -p 8001 fxf.asgi:channel_layer
start_worker.sh

#!/usr/bin/env bash source /opt/python/run/venv/bin/activate && source /opt/python/current/env python /opt/python/current/app/fxf/manage.py runworker
supervisord.conf

`

[unix_http_server]
file=/tmp/supervisor.sock   ; (the path to the socket file)

[supervisord]
logfile=/tmp/supervisord.log ; supervisord log file
loglevel=error ; info, debug, warn, trace
logfile_maxbytes=50MB        ; (max main logfile bytes b4 rotation;default 50MB)
logfile_backups=10           ; (num of main logfile rotation backups;default 10)
pidfile=/tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
nodaemon=false               ; (start in foreground if true;default false)
minfds=1024                  ; (min. avail startup file descriptors;default 1024)
minprocs=200                 ; (min. avail process descriptors;default 200)

; the below section must remain in the config file for RPC
; (supervisorctl/web interface) to work, additional interfaces may be
; added by defining them in separate rpcinterface: sections
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[supervisorctl]
serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL  for a unix socket

[program:Daphne]
environment=PATH="/opt/python/run/venv/bin"
command=sh /opt/python/current/app/fxf/custom_eb_deployment/start_daphne.sh --log-file /tmp/start_daphne.log
directory=/opt/python/current/app
autostart=true
autorestart=true
redirect_stderr=true
stdout_logfile=/tmp/daphne.out.log
stderr_logfile=/tmp/daphne.err.log

[program:Worker]
environment=PATH="/opt/python/run/venv/bin"
command=sh /opt/python/current/app/fxf/custom_eb_deployment/start_worker.sh --log-file /tmp/start_worker.log
directory=/opt/python/current/app
process_name=%(program_name)s_%(process_num)02d
numprocs=2
autostart=true
autorestart=true
redirect_stderr=true
stdout_logfile=/tmp/workers.out.log
stderr_logfile=/tmp/workers.err.log

; When resorting to send SIGKILL to the program to terminate it
; send SIGKILL to its whole process group instead,
; taking care of its children as well.
killasgroup=true

`

如果有些人仍在为这个 conf 苦苦挣扎，我可能会 post 一个 tuto on medium 之类的。不要犹豫，督促我寻找答案 ;)

AWS 应用程序负载均衡器上的 Websocket + SSL

Websocket + SSL on AWS Application Load Balancer

ssl

websocket

amazon-elastic-beanstalk

django-channels