Hey all!
I'm not sure if my problem is even related to the Rust part, but it's an issue with my Rust project so I'm asking it here. Thanks!
Ok, so I have a Rust websocket server that is basically a modified version of this project (handling other websocket messages for my application): GitHub - tmsdev82/basic-warp-websocket-server-tutorial
It runs locally on my macbook at ws://127.0.0.1:8000/ws
I can connect there from a few different clients. Nice!
So now I want to deploy it for real. I rent an ubuntu server and use lets encrypt certbot to register SSL for "quackers-beta.jimlynchcodes.com" and "www.quackers-beta.jimlynchcodes.com"
I then use cross-rs to make a build that supports linux, move it over to my server using scp, and then run it with "/root/live/quackers-ws-server"
It shows the same output as running locally: Starting server on ws://127.0.0.1:8000/ws
I have nginx set up using the file "/etc/nginx/sites-available/quackers-beta.jimlynchcodes.com" with this contents that I THOUGHT should be routing the incoming ssl traffic to that locally running process:
(Note that the CORS part is commented out)
located in the file: /etc/nginx/sites-available/quackers-beta.jimlynchcodes.comserver
{
listen 80;
server_name quackers-beta.jimlynchcodes.com;
# Redirect HTTP to HTTPS
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name quackers-beta.jimlynchcodes.com;
# SSL/TLS Configuration
ssl_certificate /etc/letsencrypt/live/quackers-beta.jimlynchcodes.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/quackers-beta.jimlynchcodes.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA>
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;
# use CORS Restrict requests to the specific itch.io domain
# if ($http_referer !~* "^https?://(www\.)?quackers-game\.itch\.io") {
# return 403; # Deny access
# }
# Add HSTS Header
add_header Strict-Transport-Security "max-age=31536000;
includeSubDomains; preload" always;
# Security Headers
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY;
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "no-referrer-when-downgrade";
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";
location /ws/ {
proxy_pass http://localhost:8000; # Adjust port based on your Rust app
# WebSocket specific headers
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; # Handle WebSocket connections
proxy_set_header Connection "upgrade";
# Default headers
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
My ufw firewall rules:
To Action From
22/tcp ALLOW Anywhere
OpenSSH ALLOW Anywhere
443/tcp ALLOW Anywhere
Nginx Full ALLOW Anywhere
443 ALLOW Anywhere
80/tcp ALLOW Anywhere
8000/tcp ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
OpenSSH (v6) ALLOW Anywhere (v6)
443/tcp (v6) ALLOW Anywhere (v6)
Nginx Full (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
8000/tcp (v6) ALLOW Anywhere (v6)
Seems like everything is up and running as expected, but when I try to connect to it from my ws clients they can't connect.
For example using wscat from command line:
wscat -c wss://quackers-beta.jimlynchcodes.com
give me the error:
error: Unexpected server response: 200
Trying with the /ws at the end:
wscat -c wss://quackers-beta.jimlynchcodes.com/ws
give the error:
error: Unexpected server response: 404
Does anyone see what I am doing wrong here? How can I setup this server to only allow this secure connection so that it allows me to connect to this running server from my clients using the secure wss?
