In the production environment of Docker / Rails / puma, part of CRUD cannot be done well by SSL communication, so I made the local environment SSL to try various things locally. I summarized the procedure at that time.

Premise

--The page can already be displayed with http connection --Use openssl to create certificate --Chrome is security and cannot be connected, so access it with firefox and verify the display and operation. --When accessing the page, a message saying that the communication is not secure is returned, but it can be displayed by selecting "Detailed information" → "Continue with awareness of danger".

Implementation procedure

#Move to the certificate installation directory
$ cd docker/nginx/ssl

$ openssl genrsa -out server.key 2048

#Registration information is appropriate. .. ..
$ openssl req -new -key server.key -out server.csr
Country Name (2 letter code) []:JP
State or Province Name (full name) []:Fukuoka prefecture
Locality Name (eg, city) []:Fukuoka city
Organization Name (eg, company) []:oreore
Organizational Unit Name (eg, section) []:oreore
Common Name (eg, fully qualified host name) []:localhost
Email Address []:[email protected]
A challenge password []:a123456

$ openssl x509 -days 3650 -req -signkey server.key -in server.csr -out server.crt

Prevent it from being uploaded to GitHub

`.gitignore`



/docker/nginx/ssl/server.crt
/docker/nginx/ssl/server.csr
/docker/nginx/ssl/server.key

Allow port 443 or fit the mount to the path with the certificate.

`docker-compose.yml`



nginx:
    build:
      context: .
      dockerfile: ./docker/nginx/Dockerfile
    ports:
      - '80:80'
      - '443:443' #add to
    volumes:
      - sockets:/app/tmp/sockets
      - ./docker/nginx/ssl:/etc/nginx/ssl #add to

Set the directory path where the certificate is located in "ssl_certificate" etc. Make it 301 redirect to https when accessing http.

`docker/nginx/default.conf`



upstream app {
  server unix:///app/tmp/sockets/puma.sock;
}

server {
  listen 80;
  server_name  _;
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  server_name localhost;

  ssl_certificate     /etc/nginx/ssl/server.crt;
  ssl_certificate_key /etc/nginx/ssl/server.key;
  ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers         HIGH:!aNULL:!MD5;

#···abridgement

$ docker-compose up -d

reference

How to make puma server SSL accessible --ryotaku's Tech Blog Enable HTTPS in Rails development environment Rails + Puma development environment SSL-Qiita Enable SSL / HTTPS in Rails5 + puma's local environment-Qiita SSL (HTTPS) settings with Nginx! Create a self-signed certificate!

finally

Now that CRUD is done under the essential local https connection, I will replace it with the certificate for this production environment and verify it again.

SSL in the local environment of Docker / Rails / puma