I'm configuring a Django server that will have very low traffic (usually only 1-2 clients at a time) with Django and Django Channels. So far, I have been using uWSGI to serve the website over TLS and it has worked really well. Now I want to use WebSockets, which is where Django Channels comes in.
I spent several hours yesterday trying to configure the uWSGI internal routing to pass the WebSockets request (by path) to the Daphne server like so in my uWSGI ini file:
route = ^/ws http:127.0.0.1:8001
The routing seems to be working fine and the request makes it to Daphne, but it appears that uWSGI isn't passing the correct headers or is otherwise modifying them as I get an error from Daphne indicating that the
Connection: Upgrade header is not present and closes the connection.
Question 1: Has anyone configured various uWSGI routing setups that can offer some tips?
Due to the low traffic and relatively low security requirements, I was planning to just use the Django Daphne project since it can serve HTTPS and WebSockets from a single simple configuration. This is my
daphne.service file for systemd management:
[Unit] Description=dapnhe After=network.target [Service] PIDFile=/run/daphne/pid User=root Group=root WorkingDirectory=/var/www/primary ExecStart=/usr/local/bin/daphne -e ssl:443:privateKey=/etc/letsencrypt/live/example.com/privkey.pem:certKey=/etc/letsencrypt/live/example.com/fullchain.pem -v 2 project.asgi:application ExecReload=/bin/kill -s HUP $MAINPID ExecStop=/bin/kill -s TERM $MAINPID Restart=on-abort PrivateTmp=true [Install] WantedBy=multi-user.target
This setup runs just fine, except that it requires me to run Daphne as root so that it can access the SSL certificate and key.
Question 2: Is there a method by which I can force the daphne process to drop back down to a non-privileged user? Can systemd do this, or does the process itself need to be written in such a way as to do this?
My last resort was going to be a full nginx, uwsgi, daphne setup, but this requires more services and configuration for a virtual machine that will likely only have a lifetime of a few days at most. I intend to script any configuration so it's not a huge deal, just more that I need to learn.
Question 3: If all services are running on the same virtual server, is there any concern over securing the connection between nginx and the backend uWSGI and Daphne servers? Are cloud private networks sufficiently secure that I could skip TLS between them if I decided on separate physical servers?