Notes on how to successfully run faye in a rails app using thin behind a https / SSL nginx proxy with basic auth

config.ru

require 'faye'

Faye::WebSocket.load_adapter('thin')
use Faye::RackAdapter, :mount => '/faye', :timeout => 25

require ::File.expand_path('../config/environment',  __FILE__)
run App::Application

faye.js.coffee

faye_url = "#{window.location.protocol}//#{window.location.host}/faye"
faye = new Faye.Client(faye_url)

# We need to disable both of these to get faye to use long-polling
faye.disable('websocket')
faye.disable('eventsource')

nginx.conf

server {
  listen 443;
  server_name example.com;

  ssl                  on;
  ssl_certificate      ssl.crt;
  ssl_certificate_key  ssl.key;
  ssl_session_timeout  5m;

  ssl_protocols  SSLv2 SSLv3 TLSv1;
  ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
  ssl_prefer_server_ciphers   on;

  location / {
    auth_basic            "Restricted";
    auth_basic_user_file  /etc/nginx/htpass;
    proxy_pass http://127.0.0.1:4488;
  }
}

start_command.sh

bundle exec thin start -p 4488

One gotcha to watch out for here is that faye stores sessions in memory, if you have multiple processes for your rails app that won't work. In that case you probably need another storage backend, like redis.

Is there a way for nginx to forward websockets?

do we require to use a different certificate from what we are using for the Rails server?