使用 ssl / nginx /gunicorn 在 vagrant box 中访问（django）应用程序的问题

Question

我正在使用 Ansible 部署 django/react 应用程序。我正在将它部署在开发 Digital Ocean 服务器上，并且在那方面一切正常。我正在使用类似的过程将其部署在 Vagrant 盒子上……这就是我遇到的麻烦。

我在从主机访问 vagrant guest 机器上的应用程序时遇到问题。我在下面详细介绍了配置（vagrant、nginx 文件）。

当我访问像 127.0.0.1:8443/time-series/ 这样的 url 时，nginx 会以 400 Bad Request The plain HTTP request was sent to HTTPS port 响应。但是，当我访问 url 127.0.0.1:8080/time-series/ 时，我得到了回复 This site can’t be reached tsango’s server IP address could not be found。因此似乎已到达 nginx，但无法提供应用程序文件。

我使用 let's encrypt certificate for localhost 网页为 localhost 创建了 ssl crt/key。

你认为我所做的有什么问题吗？还有什么是调试此类问题的好方法？

Vagrantfile 是：

# -*- mode: ruby -*-
# vi: set ft=ruby :

# Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
VAGRANTFILE_API_VERSION = "2"

Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
  config.vm.box = "ubuntu/bionic64"
  config.ssh.forward_agent = true
  config.vm.define "tsango", primary: true do |app|
    app.vm.hostname = "tsango"
#    app.vm.network "private_network", type: "dhcp"
    app.vm.network "forwarded_port", guest: 80, host: 8080
    app.vm.network "forwarded_port", guest: 443, host: 8443
  end

  config.vm.provider "virtualbox" do |vb|
    vb.customize ["modifyvm", :id, "--name", "Tsango", "--memory", "2048"]
  end

  # Ansible provisioner.
  config.vm.provision "ansible" do |ansible|
    ansible.playbook = "vagrant.yml"
    ansible.host_key_checking = false
    ansible.verbose = "vv"
  end
end

而 Nginx 的配置文件是：

upstream tsango_wsgi_server {
  server unix:/webapps/tsango/run/gunicorn.sock fail_timeout=0;
}

server {
    listen      80;
    server_name tsango;
    server_tokens off;
    return 301  https://$server_name$request_uri;
}

server {
    listen              443 ssl;
    server_name         tsango;
    server_tokens       off;
        ssl_certificate     /etc/ssl/tsango.crt;
    ssl_certificate_key /etc/ssl/tsango.key;
        ssl_protocols       TLSv1.2;
    ssl_ciphers         'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;

    # Prevent MIME type sniffing for security
    add_header X-Content-Type-Options "nosniff";

    # Enable XSS Protection in case user's browser has disabled it
    add_header X-XSS-Protection "1; mode=block";

    client_max_body_size 4G;

    access_log /webapps/tsango/logs/nginx_access.log;
    error_log /webapps/tsango/logs/nginx_error.log;

    location /static/ {
        alias   /webapps/tsango/static/;
    }

    location /media/ {
        alias   /webapps/tsango/media/;
    }

    location / {
        if (-f /webapps/tsango/maintenance_on.html) {
            return 503;
        }

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Host $http_host;
        proxy_redirect off;

        # Try to serve static files from nginx, no point in making an
        # *application* server like Unicorn/Rainbows! serve static files.
        if (!-f $request_filename) {
            proxy_pass http://tsango_wsgi_server;
            break;
        }
    }

    # Error pages
    error_page 500 502 504 /500.html;
    location = /500.html {
        root /webapps/tsango/tsango/tsango/templates/;
    }

    error_page 503 /maintenance_on.html;
    location = /maintenance_on.html {
        root /webapps/tsango/;
    }
}

Answer 1

我发现了问题：我创建的 ssl 本地证书被命名为 localhost 而不是 tsango。