Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hey, I have a rails app and I am already redirecting nearly all traffic to use https. However, there is a particular path in my app which I need accessible by plain http, say somedomain.com/special.

I am wondering if this is even possible, as my rails app seems to be defined in the https block. Perhaps if there's some way to host it both on http and https, then redirect all traffic from http to https if it is not /special? (I also need /RPC2 to be on http, but that's not a rails path which is why that does work right now).

I would greatly appreciate any advice. If you see any glaring mistakes in my configuration I would also appreciate it if you pointed them out!

server {
   listen 80;
   server_name somedomain.com;

   location / {
      rewrite ^ https://somedomain.com$request_uri? permanent;
   }

   location /RPC2 {
      include scgi_params;
      scgi_pass 127.0.0.1:5000;
      auth_basic "app";
      auth_basic_user_file /var/www/server/basic.auth;
   }
}

server {
   listen 443 default ssl;

   server_name somedomain.com;
   root /var/www/sites/app/current/public;
   passenger_enabled on;
   rails_env production;

   ssl_certificate /etc/ssl/certs/myssl.crt;
   ssl_certificate_key /etc/ssl/certs/myssl.key;
   ssl_protocols SSLv2 SSLv3 TLSv1;
   ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

   location /downloads {
      autoindex on;
      autoindex_exact_size off;
      auth_basic "node";
      auth_basic_user_file /var/www/server/basic.auth;
      alias /var/www/downloads/;
   }
}

Thanks again!

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

I suppose you can get by with proxy_passing to the https server.

server {
   listen 80;
   location /special {
      proxy_pass https://localhost:443;
      proxy_set_header X-Real-IP $remote_addr;
   }
}

If it works for you, check the app and nginx access logs for /special requests. If logged IPs are 127.0.0.1, enable nginx's http_realip module and add

set_real_ip_from 127.0.0.1;
real_ip_header X-Real-IP;

in ssl server config.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.