[AWS] Publish rails app with nginx + puma

Introduction

I made a LINE bot with rails, so Try setting to publish the rails application with nginx + puma.

Create an EC2 instance

Set up an EC2 instance referring to here.

Reference: Try building a web server on AWS EC2 https://qiita.com/Arashi/items/629aaed33401b8f2265c

Set things necessary for development such as git and rails first

Check the location of the Rails app

If you have a Rails app under your home directory Move or copy under "/ opt". Note that the home directory is not a good place to put the apps you want to publish.

• If you keep your home directory, you will easily get hooked on permission errors.

Copy Rails app

#When copying
$ sudo cp -arf ~/rails/rails_app/opt/
#Check the file
$ ls -al /opt/
drwxr-xr-x 5 root root 4096 July 15 13:59 .
dr-xr-xr-x 25 root root 4096 July 16 06:02 ..
drwxrwxr-x 13 ec2-user ec2-user 4096 July 15 13:57 rails_app

Set Nginx

First install

Install Nginx

$ sudo yum install -y nginx

Version confirmation

$ nginx -v
nginx version: nginx/1.16.1

Write settings to config file

ruby:/etc/nginx/conf.d/rails.conf

server {
    listen       80;
    server_name  localhost;

    access_log  /var/log/nginx/access.log;
    error_log   /var/log/nginx/error.log;

    root /opt/rails_app/public;

    #Follow the document root in order from the beginning below
    try_files $uri @rails_app;

    #above@rails_Load the following settings only when the app is called
    location @rails_app {
        proxy_pass http://rails_app;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;
    }
}

Try moving it once

Start-up

$ sudo nginx

Stop

$ sudo nginx -s stop

Oh! !! moved! !!

Puma socket communication settings

Modify Puma's configuration file to make Rails (Puma) and Nginx work together

• Note that if there is a Rails app under the home, Nginx cannot communicate with Puma by socket.

/opt/rails_app/config/puma.rb

#Comment out here
#port        ENV.fetch("PORT") { 3000 }

#Add this line
bind "unix:///opt/rails_app/tmp/sockets/puma.sock"

Added the cooperation part to rails.conf

ruby:/etc/nginx/conf.d/rails.conf

#Add the following code
upstream rails_app {
    #UNIX domain socket communication settings
    server unix:///opt/rails_app/tmp/sockets/puma.sock fail_timeout=0;
}

It will be linked when rails is executed.

error

Your version of SQLite (3.7.17) is too old. Active Record supports SQLite >= 3.8.

Wow! !! Somehow I got angry ...

If you want to use SQLite with Ruby on Rails 6, it seems that you need SQLite 3.8 or above. The SQLite package contains 3.7 ... Install the latest version of SQLite to solve the problem.

# 3.Download 29
$ wget https://www.sqlite.org/2019/sqlite-autoconf-3290000.tar.gz

$ tar xzvf sqlite-autoconf-3290000.tar.gz

$ cd sqlite-autoconf-3290000

#Don't conflict with the original sqlite/opt/sqlite/Install on sqlite3
$ ./configure --prefix=/opt/sqlite/sqlite3

$ make

$ sudo make install

#Version confirmation
$ /opt/sqlite/sqlite3/bin/sqlite3 --version
3.29.0 2019-07-10 17:32:03 fc82b73eaac8b36950e527f12c4b5dc1e147e6f4ad2217ae43ad82882a88bfa6

#Reinsert sqlite3 gem
$ gem uninstall sqlite3

#Install by specifying the lib and include paths entered above
$ gem install sqlite3 -- --with-sqlite3-include=/opt/sqlite/sqlite3/include \
   --with-sqlite3-lib=/opt/sqlite/sqlite3/lib

Try moving rails again ...

Oh! !! moved! !!

SSL settings! Create a certificate

By the way, let's set up SSL as well

Install OpenSSL

Check and install OpenSSL

#Check openssl version
$ openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

#If the version is not displayed, install
$ sudo yum install -y openssl

Directory creation

$ sudo mkdir /etc/nginx/ssl

Creating a private key

$ sudo openssl genrsa -out /etc/nginx/ssl/server.key 2048

Creating a CSR (Certificate Signing Request)

Create a "CSR (Certificate Signing Request)" from the private key

You will be asked to enter the country code, address, company name, etc., but if it is a self-signed certificate, it is unnecessary, so do not enter anything and skip it with "Enter".

Create a CSR

$ sudo openssl req -new -key /etc/nginx/ssl/server.key -out /etc/nginx/ssl/server.csr

Creating a CRT (SSL server certificate)

Originally, I would register the CSR I mentioned earlier with a certificate authority and have them issue a "CRT (SSL server certificate)", but this time I made an "Oreore (self-signed) certificate" and this machine. Completed within

Create a CRT

#Create a CRT (expiration date 10 years)
$ sudo openssl x509 -days 3650 -req -signkey /etc/nginx/ssl/server.key -in /etc/nginx/ssl/server.csr -out /etc/nginx/ssl/server.crt

#Confirm that the CRT has been generated
$ ls -l /etc/nginx/ssl/
12 in total
-rw-r--r--1 root root 1103 July 14 11:52 server.crt
-rw-r--r--1 root root 952 July 14 11:52 server.csr
-rw-r--r--1 root root 1675 July 14 11:51 server.key

Set certificate in Nginx

ruby:/etc/nginx/conf.d/rails.conf

server {
    #Allow port 443 and turn on SSL function
    # listen 80;
    listen 443 ssl;
    server_name  {#server_name};

    #Set certificate
    ssl_certificate     /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
         ：
         ：
}

Reboot

$ sudo restart nginx

I was able to connect with SSL! !!

• The Oreore certificate is used only for development and study.