Ratchet: Nginx config with HTTP/2

[jacklenox]

I've spent a horribly large amount of time trying to get reverse proxying to work with Ratchet and websockets on a DigitalOcean droplet. I'm still fairly new to the whole thing so I _must_ be doing something stupid somewhere. My nginx config looks like this:

map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
}

server {
        listen 443 ssl http2;
        server_name vegourmand.com;

        root /var/www/html;
        index index.php index.html index.htm;

        ssl on;
        ssl_certificate /etc/letsencrypt/live/vegourmand.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/vegourmand.com/privkey.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers '[redacted]';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;

        proxy_buffering off;

        location / {
                try_files $uri $uri/ /index.php?q=$uri&$args;
        }

        location ~ \.php$ {
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
        }

        location ~ /.well-known {
                allow all;
        }

        location /socket {
                proxy_pass http://127.0.0.1:8000;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_redirect http:// https://;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }

}

server {
        listen 8080;
        server_name vegourmand.com;
        root /var/www/html;
        index index.php;
        port_in_redirect off;


        #ssl on;
        ssl_certificate /etc/letsencrypt/live/vegourmand.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/vegourmand.com/privkey.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers '[redacted]';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;

        location / {
                try_files $uri $uri/ /index.php?$args;
        }

        location ~ \.php$ {
                try_files $uri =404;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                include fastcgi_params;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_param HTTPS on;
                fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        }
}

As you can perhaps see, I'm running a regular installation of WordPress on the same server and was hoping to add some websockety goodness to it. But instead I'm at my wit's end!

All I've managed to see so far at wss://vegourmand.com/socket is ERR_DISALLOWED_URL_SCHEME. I've scoured every guide about this and tried almost every permutation I can think of including subdomains etc.

The only thing I've noticed that seems to be a difference between me and most tutorials is that my site is on HTTP/2. I wonder if that might be what needs some extra config (noting that the websocket proxy_http_version is 1.1).

[siolfyr]

I'm using HTTP/2 with Ratchet and Nginx on my site, and everything seems to be working fine. Here's the proxy section of my server block:

location /the_socket{
    # Path rewriting
    rewrite /the_socket/(.*) /$1 break;
    proxy_redirect off;

    # switch off logging
    access_log off;

    # redirect all HTTP traffic to localhost
    proxy_pass http://localhost:1234;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # WebSocket support (nginx 1.4)
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    # timeout extension, possibly keep this short if using a ping strat.
    proxy_read_timeout 300s;
}

Http/2 should be fine on Nginx if you have nginx >= 1.9.5.

[jacklenox]

@siolfyr Wow, thank you _so much_! Magically, this got it working. I don't know what I was doing wrong. However I have discovered that apparently trying to access a socket in a browser like Chrome with the wss://example.com/socket URL doesn't necessarily tell you whether it's working or not.

According to Chrome the socket wasn't working, but when I actually tried connecting and subscribing via Autobahn, it worked fine!

I'm so delighted to finally have this configured on a remote server _and_ with SSL enabled.