7 Running with a Proxy
If you are running RStudio Connect behind a proxy server, you need to be sure to configure the proxy server so that it correctly handles all traffic to and from RStudio Connect. This section describes how to correctly configure a reverse proxy with Nginx or Apache HTTPD.
When RStudio Connect is behind a proxy, it is important that we send the original request URL information to Connect so that it can generate FQDN URLs and return them the requester. For this reason, when proxying to Connect, we recommend adding a header, X-RSC-Request
, to the request. This header value should be the absolute URL of the original request made by the user or browser (i.e. https://connect.company.com/some/path
)
Some proxies (like Amazon Web Services Elastic Load Balancer, for example), do not make it possible to add custom headers. Because of this, if this header is not supplied, “best efforts” are made utilizing the standard headers X-Forwarded-Proto
, X-Forwarded-Host
, and X-Forwarded-Port
to parse the original request URL. If your proxy removes a server prefix from the path, X-Forwarded
headers will not work for your use case, and you should use X-RSC-Request
. If both X-RSC-Request
and X-Forwarded
headers are supplied, X-RSC-Request
takes precedence.
If your proxy secures traffic with SSL, but uses an insecure (HTTP) connection to Connect, Connect Dashboard users will see a warning about accessing Connect over an insecure connection. You can disable this warning by using the Http.NoWarning = true
configuration setting. See A.3.
7.1 Nginx Configuration
On Ubuntu, a version of Nginx that supports reverse-proxying can be installed using the following command:
sudo apt-get install nginx
On Red Hat/CentOS, you can install Nginx using the following command:
sudo yum install nginx
On SUSE, you can install Nginx using the following command:
sudo zypper install nginx
To enable an instance of Nginx running on the same server to act as a front-end proxy to RStudio Connect you would add commands like the following to your nginx.conf
file. This configuration assumes RStudio Connect is running on the same host as Nginx and listening for HTTP requests on the :3939
port. If you are proxying to RStudio Connect on a different machine or port, replace the localhost:3939
references with the correct address of the server where RStudio Connect is hosted.
http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
client_max_body_size 0; # Disables checking of client request body size
location / {
proxy_set_header X-RSC-Request $scheme://$host:$server_port$request_uri;
proxy_pass http://localhost:3939;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_http_version 1.1;
proxy_buffering off; # Required for XHR-streaming
}
}
}
If you want to serve RStudio Connect from a custom path (e.g. /rsconnect
) you would edit your nginx.conf
file as shown below:
http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
client_max_body_size 0; # Disables checking of client request body size
location /rsconnect/ {
rewrite ^/rsconnect/(.*)$ /$1 break;
proxy_set_header X-RSC-Request $scheme://$host:$server_port$request_uri;
proxy_pass http://localhost:3939;
proxy_redirect / /rsconnect/;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_http_version 1.1;
}
}
}
After adding these entries you’ll then need to restart Nginx so that the proxy settings take effect.
On systemd
systems (Red Hat/CentOS 7/SUSE 12, Ubuntu 16.04):
sudo systemctl restart nginx
On upstart
systems (Ubuntu 14.04, Red Hat 6):
sudo restart nginx
7.2 Apache Configuration
The Apache HTTPD server can act as a front-end proxy to RStudio Connect by first enabling three modules:
a2enmod rewrite
a2enmod headers
a2enmod proxy_http
The following configuration will permit proxying to RStudio Connect. Depending on the layout of your Apache installation, you may need the Listen
and VirtualHost
directives in different files.
Listen 80
<VirtualHost *:80>
RewriteEngine on
RequestHeader set X-RSC-Request "%{REQUEST_SCHEME}s://%{HTTP_HOST}s%{REQUEST_URI}s"
RewriteCond %{HTTP:Upgrade} =websocket
RewriteRule /(.*) ws://172.17.0.1:3939/$1 [P,L]
RewriteCond %{HTTP:Upgrade} !=websocket
RewriteRule /(.*) http://172.17.0.1:3939/$1 [P,L]
ProxyPass / http://172.17.0.1:3939/
ProxyPassReverse / http://172.17.0.1:3939/
</VirtualHost>
You can serve RStudio Connect from a custom path (e.g. /rsconnect
) with a configuration like the following:
Listen 80
<VirtualHost *:80>
RewriteEngine on
RedirectMatch ^/rsconnect$ /rsconnect/
RequestHeader set X-RSC-Request "%{REQUEST_SCHEME}s://%{HTTP_HOST}s%{REQUEST_URI}s"
RewriteCond %{HTTP:Upgrade} =websocket
RewriteRule /rsconnect/(.*) ws://172.17.0.1:3939/$1 [P,L]
RewriteCond %{HTTP:Upgrade} !=websocket
RewriteRule /rsconnect/(.*) http://172.17.0.1:3939/$1 [P,L]
ProxyPass /rsconnect/ http://172.17.0.1:3939/
ProxyPassReverse /rsconnect/ http://172.17.0.1:3939/
Header edit Location ^/ /rsconnect/
</VirtualHost>