actioncable: subscription to channel fails in production with ssl

Question

jruby 9.3.6 (hence ruby 2.6.8), rails 6.1.6.1. in production using ssl (wss) with devise, puma, nginx.

Locally actioncable is running without problems, but on the external server actioncable establishes a Websocket connection, leading to nginx: GET /cable HTTP/1.1" 101 210, the user gets verified correctly from the expanded session_id in the cookie, and after "Successfully upgraded to WebSocket", the browser receives a {"type":"welcome"} and pings.

Hence the actioncable javascript sends a request to subscribe to a channel, but that doesn't have success.

I tried a lot regarding the configuration of nginx, e.g. switching to passenger for the actioncable location /cable in nginx, and after 5 days I even changed from calling the server side of actioncable from a simple "new Websocket" in javascript to the client-side implementation of actioncable - as is designed to be (using import maps and actioncable.esm.js), but it didn't solve the main problem.

The logfiles:

production.log:

[ActionCable connect in app/channels/application_cable/connection.rb:] WebSocket error occurred: Broken pipe -

If the domain.com is called once, this error takes place every time 0.2 Seconds. If the page is closed, the error continues. The 0.2 seconds is the same frequency with which the browser sends the requests to subscribe to the channel. I assumed a log time, it would have to do with ssl, but I don't catch the problem. So now, I assume that the "broken pipe" is a problem between the jruby app and actioncable on the server side. But I am not sure and actually I don't know, how to troubleshoot there.

Additional there is a warning in puma.stderr.log:

warning: thread "Ruby-0-Thread-27: 
/home/my_app/.rbenv/versions/jruby-9.3.6.0/lib/ruby/gems/shared/gems/actioncable-6.1.6.1/lib/action_cable/connection/stream_event_loop.rb:75" terminated with exception (report_on_exception is true):
ArgumentError: mode not supported for this object: r

starting redis-cli and doing 'monitor':

1660711192.522723 [1 127.0.0.1:33630] "select" "1"
1660711192.523545 [1 127.0.0.1:33630] "client" "setname" "ActionCable-PID-199512"

publishing to MessagesChannel_1 works:

1660711192.523831 [1 127.0.0.1:33630] "publish" "messages_1" "{\"message\":\"message-text\"}"

In comparison in the local development configuration, this looks different:

1660712957.712189 [1 127.0.0.1:46954] "select" "1"
1660712957.712871 [1 127.0.0.1:46954] "client" "setname" "ActionCable-PID-18600"
1660712957.713495 [1 127.0.0.1:46954] "subscribe" "_action_cable_internal"
1660712957.716100 [1 127.0.0.1:46954] "subscribe" "messages_1"
1660712957.974486 [1 127.0.0.1:46952] "publish" "messages_3" "{\"message\":\"message-text\"}"

So what is "_action_cable_internal", and why doesn't it take place in production? I found the code for the actioncable gem and added 'p @pubsub' in gems/actioncable-6.1.6.1/lib/action_cable/server/base.rb at the end of the def pubsub -function and compared that information with the local configuration.

locally there is an info:

@thread=#

which corresponds to the info at the server:

@thread=#

So it looks like the "warning" was an 'error'.

Also I am not sure, if the output of wscat / curl is normal or reports an error:

root@server:~# wscat -c wss://domain.tld
error: Unexpected server response: 302

Which could be normal due to missing '/cable'. But:

root@server:~# wscat -c wss://domain.tld/cable
error: Unexpected server response: 404

root@server:~# curl -I https://domain.tld/cable
HTTP/1.1 404 Not Found

the configurations: nginx.conf:

http {
  upstream app {
    # Path to Puma SOCK file, as defined previously
    server unix:///var/www/my_app/shared/sockets/puma.sock fail_timeout=0;
  }
  server {
    listen 443 ssl default_server;
    server_name  domain.com www.domain.com;
    include snippets/ssl-my_app.com.conf;
    include snippets/ssl-params.conf;
    root /var/www/my_app/public;
    try_files $uri /index.html /index.htm;
    location /cable {
      proxy_pass http://app;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Ssl on;
      proxy_set_header X-Forwarded-Proto https;
    }
    location / {
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Host $http_host;
      proxy_redirect off;
      add_header X-Frame-Options SAMEORIGIN always;
      proxy_pass http://app;
    }
    rails_env production;
} }

cable.yml:

production:
  adapter: redis
  url: redis://127.0.0.1:6379/1
  ssl_params:
    verify_mode: <%= OpenSSL::SSL::VERIFY_NONE %>

initializer/redis.rb:

$redis = Redis.new(:host => 'domain.com/cable', :port => 6379)

routes.rb:

mount ActionCable.server => '/cable'

config/environments/production.rb:

config.force_ssl = true
config.action_cable.allowed_request_origins = [/http:\/\/*/, /https:\/\/*/]
config.action_cable.allow_same_origin_as_host = true
config.action_cable.url = "wss://domain.com/cable"

I assume that is has to do with the ssl, but I am not an expert for configurations, so thank you very much for any help.

actioncable: subscription to channel fails in production with ssl

Answers (1)

Related Questions