Question

我创建了一个Flask网站，该网站在Digital Ocean VPN上提供Bokeh应用程序。一切正常，直到我使用this tutorial后的Let's Encrypt保护服务器。

在本教程的第3步中，Nginx配置文件已更改，这可能是我遇到的问题的关键所在：

当我访问网站时，Flask内容呈现完美。但是，Bokeh应用程序未运行。在检查控制台中，我收到以下错误（请注意，我删除了我网站的IP地址）：

Mixed Content: The page at 'https://example.com/company_abc/' was loaded over HTTPS, 
but requested an insecure script 
'http://###.###.###.##:5006/company_abc/autoload.js?bokeh-autoload-element=f…aab19c633c95&bokeh-session-id=AvWhaYqOzsX0GZPOjTS5LX2M7Z6arzsBFBxCjb0Up2xP'. 
This request has been blocked; the content must be served over HTTPS.

据我所知，我可能不得不使用一种称为反向代理的方法，该方法描述为here。但是，我无法让它工作。

有人知道如何解决这个问题吗？描述了类似的问题here。

以下是我修改过的服务器文件：

'的/ etc / nginx的/位点可用/默认'：

upstream flask_siti {
        server 127.0.0.1:8118 fail_timeout=0;
}
server {
        listen 443 ssl;

        server_name example.com www.example.com;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers '###';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;

        charset utf-8;
        client_max_body_size 75M;

        access_log /var/log/nginx/flask/access.log;
        error_log  /var/log/nginx/flask/error.log;

        keepalive_timeout 5;

        location / {
                # checks for static file, if not found proxy to the app
                try_files $uri @proxy_to_app;
        }

        location @proxy_to_app {
                proxy_redirect off;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://flask_siti;
        }
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

'的/ etc /主管/ conf.d / bokeh_serve.conf'：

[program:bokeh_serve]
command=/opt/envs/virtual/bin/bokeh serve company_abc.py company_xyz.py --allow-websocket-origin=www.example.com --allow-websocket-origin=example.com --host=###.###.###.##:5006 --use-xheaders
directory=/opt/webapps/flask_telemetry
autostart=false
autorestart=true
startretries=3
user=nobody

'的/ etc /主管/ conf.d / flask.conf'

[program:flask]
command=/opt/envs/virtual/bin/gunicorn -b :8118 website_app:app
directory=/opt/webapps/flask_telemetry
user=nobody
autostart=true
autorestart=true
redirect_stderr=true

这是我的Flask应用程序（注意我已经删除了与安全相关的信息）：

from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask import render_template, request, redirect, url_for
from flask_security import Security, SQLAlchemyUserDatastore, UserMixin, RoleMixin, login_required, roles_accepted, current_user
from flask_security.decorators import anonymous_user_required
from flask_security.forms import LoginForm
from bokeh.embed import autoload_server
from bokeh.client import pull_session
from wtforms import StringField
from wtforms.validators import InputRequired
from werkzeug.contrib.fixers import ProxyFix

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'postgresql://###:###@localhost/telemetry'
app.config['SECRET_KEY'] = '###'
app.config['SECURITY_REGISTERABLE'] = True
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
app.config['SECURITY_USER_IDENTITY_ATTRIBUTES'] = 'username'
app.config['SECURITY_POST_LOGIN_VIEW'] = '/re_direct'
app.debug = True
db = SQLAlchemy(app)

# Define models
roles_users = db.Table('roles_users',
        db.Column('user_id', db.Integer(), db.ForeignKey('user.id')),
        db.Column('role_id', db.Integer(), db.ForeignKey('role.id')))

class Role(db.Model, RoleMixin):
    id = db.Column(db.Integer(), primary_key=True)
    name = db.Column(db.String(80), unique=True)
    description = db.Column(db.String(255))

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(255), unique=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())
    confirmed_at = db.Column(db.DateTime())
    roles = db.relationship('Role', secondary=roles_users,
                            backref=db.backref('users', lazy='dynamic'))

class ExtendedLoginForm(LoginForm):
    email = StringField('Username', [InputRequired()])

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore, login_form=ExtendedLoginForm)

# Views
@app.route('/')
@anonymous_user_required
def index():
    return render_template('index.html')

@app.route('/re_direct/')
@login_required
def re_direct():
    identifier = current_user.username
    print(identifier)
    return redirect(url_for(identifier))

@app.route('/index/')
@login_required
@roles_accepted('admin')
def admin():
    return render_template('admin.html')

@app.route("/company_abc/")
@login_required
@roles_accepted('company_abc', 'admin')
def company_abc():
    url='http://###.###.###.##:5006'
    session=pull_session(url=url,app_path="/company_abc")
    bokeh_script=autoload_server(None,app_path="/company_abc",session_id=session.id,url=url)
    return render_template("company_abc.html", bokeh_script=bokeh_script)

app.wsgi_app = ProxyFix(app.wsgi_app)

if __name__ == '__main__':
    app.run()

Answer 1

我在forum.nginx.org的Francis Daly和Bokeh google group的Bryan Van de ven的帮助下找到了解决方案。

基本上，在Nginx服务器后面没有正确配置Bokeh应用程序。这就是我做的工作：

将bokeh应用程序从company_abc.py重命名为company_abc-app.py，以区分应用程序和URI中使用的用户名。
要运行Bokeh应用程序，我使用了选项--use-xheaders
在散步服务调用中更改了一些--allow-websocket-origin和--host选项，并让它在localhost：5006上运行
在Nginx配置文件中，我为Bokeh应用程序（/ company_abc-app /）声明了一个特定位置并将其放在位置/
在Flask应用程序中，我从localhost：5006中提取Bokeh会话，但随后更改autoload_server的URL以包含https，即https://example.com，这是关键，我认为。

以下是有效的文件：

'的/ etc / nginx的/位点可用/默认'：

upstream flask_siti {
        server 127.0.0.1:8118 fail_timeout=0;
}
upstream bokeh_siti {
        server 127.0.0.1:5006 fail_timeout=0;
}
server {
            listen 443 ssl;
            server_name example.com www.example.com;

            ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers '###';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;

        charset utf-8;
        client_max_body_size 75M;

        access_log /var/log/nginx/flask/access.log;
        error_log  /var/log/nginx/flask/error.log;

        keepalive_timeout 5;

        location /company_abc-app/ {
                  proxy_pass http://bokeh_siti;
                  proxy_set_header Upgrade $http_upgrade;
                  proxy_set_header Connection "upgrade";
                  proxy_http_version 1.1;
                  proxy_set_header X-Forwarded-Proto $scheme;
                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                  proxy_set_header Host $host:$server_port;
                  proxy_buffering off;
        }

        location / {
                # checks for static file, if not found proxy to the app
                try_files $uri @proxy_to_app;
        }

        location @proxy_to_app {
                  proxy_pass http://flask_siti;
                  proxy_set_header Upgrade $http_upgrade;
                  proxy_set_header Connection "upgrade";
                  proxy_http_version 1.1;
                  proxy_set_header X-Forwarded-Proto $scheme;
                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                  proxy_set_header Host $host:$server_port;
                  proxy_buffering off;
        }
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

'的/ etc /主管/ conf.d / bokeh_serve.conf'：

[program:bokeh_serve]
command=/opt/envs/virtual/bin/bokeh serve company_abc-app.py --allow-websocket-origin=example.com --allow-websocket-origin=www.example.com --port=5006 --host=example.com:443 --host=www.example.com:443 --host=127.0.0.1:5006 --use-xheaders
directory=/opt/webapps/flask_telemetry
autostart=false
autorestart=true
startretries=3
user=nobody

'的/ etc /主管/ conf.d / flask.conf'

[program:flask]
command=/opt/envs/virtual/bin/gunicorn -b :8118 website_app:app
directory=/opt/webapps/flask_telemetry
user=nobody
autostart=true
autorestart=true
redirect_stderr=true

这是我的Flask应用程序（注意我已经删除了与安全相关的信息）：

from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask import render_template, request, redirect, url_for
from flask_security import Security, SQLAlchemyUserDatastore, UserMixin, RoleMixin, login_required, roles_accepted, current_user
from flask_security.decorators import anonymous_user_required
from flask_security.forms import LoginForm
from bokeh.embed import autoload_server
from bokeh.client import pull_session
from wtforms import StringField
from wtforms.validators import InputRequired
from werkzeug.contrib.fixers import ProxyFix

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'postgresql://user:password@localhost/telemetry'
app.config['SECRET_KEY'] = '###'
app.config['SECURITY_REGISTERABLE'] = True
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
app.config['SECURITY_USER_IDENTITY_ATTRIBUTES'] = 'username'
app.config['SECURITY_POST_LOGIN_VIEW'] = '/re_direct'
app.debug = True
db = SQLAlchemy(app)

# Define models
roles_users = db.Table('roles_users',
        db.Column('user_id', db.Integer(), db.ForeignKey('user.id')),
        db.Column('role_id', db.Integer(), db.ForeignKey('role.id')))

class Role(db.Model, RoleMixin):
    id = db.Column(db.Integer(), primary_key=True)
    name = db.Column(db.String(80), unique=True)
    description = db.Column(db.String(255))

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(255), unique=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())
    confirmed_at = db.Column(db.DateTime())
    roles = db.relationship('Role', secondary=roles_users,
                            backref=db.backref('users', lazy='dynamic'))

class ExtendedLoginForm(LoginForm):
    email = StringField('Username', [InputRequired()])

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore, login_form=ExtendedLoginForm)

# # Create a user to test with
# @app.before_first_request
# def create_user():
#     print('Create User')
#     db.create_all()
#     user_datastore.create_role(name='company_abc')
#     user_datastore.create_role(name='admin')
#     user_datastore.create_user(username='company_abc', password='###', roles=['company_abc'])
#     user_datastore.create_user(username='admin', password='###', roles=['admin'])
#     db.session.commit()
#     print('User created')

# Views
@app.route('/')
@anonymous_user_required
def index():
    return render_template('index.html')

@app.route('/re_direct/')
@login_required
def re_direct():
    identifier = current_user.username
    print(identifier)
    return redirect(url_for(identifier))

@app.route('/index/')
@login_required
@roles_accepted('admin')
def admin():
    return render_template('admin.html')

@app.route("/company_abc/")
@login_required
@roles_accepted('company_abc', 'admin')
def company_abc():
    url='http://127.0.0.1:5006'
    session=pull_session(url=url,app_path="/company_abc-app")
    url_https='https://company_abc.net'
    bokeh_script=autoload_server(None,app_path="/company_abc-app",session_id=session.id,url=url_https)
    return render_template("company_abc.html", bokeh_script=bokeh_script)

app.wsgi_app = ProxyFix(app.wsgi_app)

if __name__ == '__main__':
    app.run()

反向代理：在Nginx上使用Bokeh服务器的Flask应用程序

1 个答案: