Rails, Nginx, XSendfile, and X-Accel-Mapping

deploy.rb

# Symlink the shared protected folder
run "ln -nfs #{shared_path}/protected #{latest_release}/protected"

documents_controller.rb

def download
  send_file @document.file.path
  # path: /app/releases/20140101010101/protected/file.pdf
end

nginx.conf

# Defines the internal location to support the X-Sendfile feature
# for the delivery of static files from the folder: /app/shared/protected
# http://wiki.nginx.org/XSendfile
location /protected/ {
  internal;
  root  /app/shared;
}

# Rack::Sendfile uses the X-Accel-Mapping header to map the file path (specified in the documents_controller.rb)
# to the internal location set in the nginx.conf.
# Rack::Sendfile takes a regular expression for the left hand side of the X-Accel-Mapping value:
# https://github.com/rack/rack-contrib/blob/master/lib/rack/contrib/sendfile.rb#L138
location @unicorn {
  proxy_set_header X-Accel-Mapping /app/releases/[\d]+/protected/=/protected/;
}

production.rb

# Specify the header only in the production.rb
# in order to allow Rails serving the files in the development:
config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect'