ssl - AWS 应用程序负载均衡器上的 Websocket + SSL

Question

我在 ElastickBeanstalk 上部署了一个 Django 应用程序。 我最近从 Classic -> Application 迁移了负载均衡器，以支持 Websocket(由 Django-channels (~=1.1.8, channels-api==0.4.0)、Redis Elasticache AWS 和 Daphne (~= 1.4))。 HTTP、HTTPS 和 Web Socket 协议(protocol)工作正常。

但我找不到通过安全 SSL 部署 Websocket 的方法。 这让我很生气，而且它正在阻塞，因为来自浏览器的 HTTPS 连接会切断不安全的 ws://对等请求。

这是我的 ALB 配置 有没有人作为解决方案？

Answer 1

经过两天多的调查，我终于破解了这个配置!

这里是答案:

1. 正确的，最小的，aws - ALB Config: 确实，我们需要

   • 解码 SSL(这不是端到端加密)

   • 将所有流量转发到 Daphne。 我之所以没有在 web conf 中进行非常广泛的传播:“/ws/*”路由到 Daphne，是因为它确实为我提供了 HandShake OK，但之后，什么都没有，nada，websocket 无法被推回订户。我认为，原因是达芙妮的回击不尊重您在 conf 中自定义的自定义基本尾随 URL。另外，我不能确定这种解释。但是我可以肯定的是，如果我不将所有流量转发给 Daphne，握手后它就不会工作。

     1. 最低部署 CONF
   • 在部署中不需要完整的 .ebextension 覆盖代理:

.ebextensions/05_channels.config

files:
  "/opt/elasticbeanstalk/hooks/appdeploy/post/start_supervisor.sh":
  mode: "000755"
  owner: root
  group: root
  content: |
    #!/usr/bin/env bash
    sudo virtualenv -p /usr/bin/python2.7 /tmp/senv
    source /tmp/senv/bin/activate && source /opt/python/current/env
    sudo python --version > /tmp/version_check.txt
    sudo pip install supervisor

    sudo /usr/local/bin/supervisord -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf
    sudo /usr/local/bin/supervisorctl -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf reread
    sudo /usr/local/bin/supervisorctl -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf update
    sudo /usr/local/bin/supervisorctl -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf restart all
    sudo /usr/local/bin/supervisorctl -c /opt/python/current/app/fxf/custom_eb_deployment/supervisord.conf status

• start_daphne.sh(备注我根据我的 ALB conf 选择 8001 端口)

  #!/usr/bin/env bash 源/opt/python/run/venv/bin/activate && 源/opt/python/current/env /opt/python/run/venv/bin/daphne -b 0.0.0.0 -p 8001 fxf.asgi:channel_layer

• start_worker.sh

  #!/usr/bin/env bash 源/opt/python/run/venv/bin/activate && 源/opt/python/current/env python/opt/python/current/app/fxf/manage.py runworker

• supervisord.conf

`

[unix_http_server]
file=/tmp/supervisor.sock   ; (the path to the socket file)

[supervisord]
logfile=/tmp/supervisord.log ; supervisord log file
loglevel=error ; info, debug, warn, trace
logfile_maxbytes=50MB        ; (max main logfile bytes b4 rotation;default 50MB)
logfile_backups=10           ; (num of main logfile rotation backups;default 10)
pidfile=/tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
nodaemon=false               ; (start in foreground if true;default false)
minfds=1024                  ; (min. avail startup file descriptors;default 1024)
minprocs=200                 ; (min. avail process descriptors;default 200)

; the below section must remain in the config file for RPC
; (supervisorctl/web interface) to work, additional interfaces may be
; added by defining them in separate rpcinterface: sections
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[supervisorctl]
serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL  for a unix socket

[program:Daphne]
environment=PATH="/opt/python/run/venv/bin"
command=sh /opt/python/current/app/fxf/custom_eb_deployment/start_daphne.sh --log-file /tmp/start_daphne.log
directory=/opt/python/current/app
autostart=true
autorestart=true
redirect_stderr=true
stdout_logfile=/tmp/daphne.out.log
stderr_logfile=/tmp/daphne.err.log

[program:Worker]
environment=PATH="/opt/python/run/venv/bin"
command=sh /opt/python/current/app/fxf/custom_eb_deployment/start_worker.sh --log-file /tmp/start_worker.log
directory=/opt/python/current/app
process_name=%(program_name)s_%(process_num)02d
numprocs=2
autostart=true
autorestart=true
redirect_stderr=true
stdout_logfile=/tmp/workers.out.log
stderr_logfile=/tmp/workers.err.log

; When resorting to send SIGKILL to the program to terminate it
; send SIGKILL to its whole process group instead,
; taking care of its children as well.
killasgroup=true

`

如果有些人仍在为这个 session 而苦苦挣扎，我可能会在 medium 或其他网站上发布教程。 不要犹豫，督促我寻找答案 ;)