Apache, Unicorn & SSL

Having used Apache with Mongrel, Thin and Passenger, I’ve now moved on to Unicorn.  Setting up Apache on Ubuntu to proxy to Unicorn requires the following installation commands:

apt-get install apache2 -y
apt-get install libapache2-mod-proxy-html libxml2-dev -y
a2enmod headers
a2enmod proxy
a2enmod proxy_http
a2enmod proxy_balancer
a2enmod rewrite
a2enmod ssl
/etc/init.d/apache2 restart

With these modules in place a virtual host can be configured something like this:

view plaincopy to clipboardprint?

1. <VirtualHost *:80>  
2.   ServerName     myhost.example.com  
3.   DocumentRoot   /opt/example/app/public  
4.   
5.   RewriteEngine On  
6.   # Redirect all non-static requests to unicorn  
7.   RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f  
8.   RewriteRule ^/(.*)$ balancer://unicornservers%{REQUEST_URI} [P,QSA,L]  
9.   
10.   <Proxy balancer://unicornservers>  
11.     Allow from any  
12.     BalancerMember http://127.0.0.1:8080  
13.   </Proxy>  
14. </VirtualHost>  
15.   
16. <VirtualHost *:443>  
17.   ServerName     myhost.example.com  
18.   DocumentRoot   /opt/example/app/public  
19.   
20.   RewriteEngine On  
21.   # Redirect all non-static requests to unicorn  
22.   RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f  
23.   RewriteRule ^/(.*)$ balancer://unicornservers%{REQUEST_URI} [P,QSA,L]  
24.   RequestHeader set X-Forwarded-Proto "https"  
25.   
26.   <Proxy balancer://unicornservers>  
27.     Allow from any  
28.     BalancerMember http://127.0.0.1:8080  
29.   </Proxy>  
30.   
31.   SSLEngine     on  
32.   SSLCertificateFile /etc/apache2/ssl/ssl.crt  
33.   SSLCertificateKeyFile /etc/apache2/ssl/ssl.key  
34. </VirtualHost>  

<VirtualHost *:80>
  ServerName     myhost.example.com
  DocumentRoot   /opt/example/app/public

  RewriteEngine On
  # Redirect all non-static requests to unicorn
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
  RewriteRule ^/(.*)$ balancer://unicornservers%{REQUEST_URI} [P,QSA,L]

  <Proxy balancer://unicornservers>
    Allow from any
    BalancerMember http://127.0.0.1:8080
  </Proxy>
</VirtualHost>

<VirtualHost *:443>
  ServerName     myhost.example.com
  DocumentRoot   /opt/example/app/public

  RewriteEngine On
  # Redirect all non-static requests to unicorn
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
  RewriteRule ^/(.*)$ balancer://unicornservers%{REQUEST_URI} [P,QSA,L]
  RequestHeader set X-Forwarded-Proto "https"

  <Proxy balancer://unicornservers>
    Allow from any
    BalancerMember http://127.0.0.1:8080
  </Proxy>

  SSLEngine     on
  SSLCertificateFile /etc/apache2/ssl/ssl.crt
  SSLCertificateKeyFile /etc/apache2/ssl/ssl.key
</VirtualHost>

mod_headers and the RequestHeader directive are useful if the Rails app is using ssl_requirement.