7 Running with a Proxy

If you are running RStudio Connect behind a proxy server, you need to be sure to configure the proxy server so that it correctly handles all traffic to and from RStudio Connect. This section describes how to correctly configure a reverse proxy with Nginx or Apache HTTPD.

When RStudio Connect is behind a proxy, it is important that we send the original request URL information to Connect so that it can generate FQDN URLs and return them the requester. For this reason, when proxying to Connect, we recommend adding a header, X-RSC-Request, to the request. This header value should be the absolute URL of the original request made by the user or browser (i.e. https://connect.company.com/some/path)

Some proxies (like Amazon Web Services Elastic Load Balancer, for example), do not make it possible to add custom headers. Because of this, if this header is not supplied, “best efforts” are made utilizing the standard headers X-Forwarded-Proto, X-Forwarded-Host, and X-Forwarded-Port to parse the original request URL. If your proxy removes a server prefix from the path, X-Forwarded headers will not work for your use case, and you should use X-RSC-Request. If both X-RSC-Request and X-Forwarded headers are supplied, X-RSC-Request takes precedence.

If your proxy secures traffic with SSL, but uses an insecure (HTTP) connection to Connect, Connect Dashboard users will see a warning about accessing Connect over an insecure connection. You can disable this warning by using the Http.NoWarning = true configuration setting. See A.3.

7.1 Nginx Configuration

On Ubuntu, a version of Nginx that supports reverse-proxying can be installed using the following command:

sudo apt-get install nginx

On Red Hat/CentOS, you can install Nginx using the following command:

sudo yum install nginx

On SUSE, you can install Nginx using the following command:

sudo zypper install nginx

To enable an instance of Nginx running on the same server to act as a front-end proxy to RStudio Connect you would add commands like the following to your nginx.conf file. This configuration assumes RStudio Connect is running on the same host as Nginx and listening for HTTP requests on the :3939 port. If you are proxying to RStudio Connect on a different machine or port, replace the localhost:3939 references with the correct address of the server where RStudio Connect is hosted.

http {
  map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
  }
  server {
    listen 80;

    client_max_body_size 0; # Disables checking of client request body size

    location / {
      proxy_set_header X-RSC-Request $scheme://$host:$server_port$request_uri;
      proxy_pass http://localhost:3939;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
      proxy_http_version 1.1;
      proxy_buffering off; # Required for XHR-streaming
    }
  }
}

If you want to serve RStudio Connect from a custom path (e.g. /rsconnect) you would edit your nginx.conf file as shown below:

http {
  map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
  }
  server {
    listen 80;

    client_max_body_size 0; # Disables checking of client request body size

    location /rsconnect/ {
      rewrite ^/rsconnect/(.*)$ /$1 break;
      proxy_set_header X-RSC-Request $scheme://$host:$server_port$request_uri;
      proxy_pass http://localhost:3939;
      proxy_redirect / /rsconnect/;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
      proxy_http_version 1.1;
    }
  }
}

After adding these entries you’ll then need to restart Nginx so that the proxy settings take effect.

On systemd systems (Red Hat/CentOS 7/SUSE 12, Ubuntu 16.04):

sudo systemctl restart nginx

On upstart systems (Ubuntu 14.04, Red Hat 6):

sudo restart nginx

7.2 Apache Configuration

The Apache HTTPD server can act as a front-end proxy to RStudio Connect by first enabling three modules:

a2enmod rewrite
a2enmod headers
a2enmod proxy_http

The following configuration will permit proxying to RStudio Connect. Depending on the layout of your Apache installation, you may need the Listen and VirtualHost directives in different files.

Listen 80

<VirtualHost *:80>
  RewriteEngine on
  RequestHeader set X-RSC-Request "%{REQUEST_SCHEME}s://%{HTTP_HOST}s%{REQUEST_URI}s"
  RewriteCond %{HTTP:Upgrade} =websocket
  RewriteRule /(.*) ws://172.17.0.1:3939/$1 [P,L]
  RewriteCond %{HTTP:Upgrade} !=websocket
  RewriteRule /(.*) http://172.17.0.1:3939/$1 [P,L]
  ProxyPass / http://172.17.0.1:3939/
  ProxyPassReverse / http://172.17.0.1:3939/
</VirtualHost>

You can serve RStudio Connect from a custom path (e.g. /rsconnect) with a configuration like the following:

Listen 80

<VirtualHost *:80>
  RewriteEngine on
  RedirectMatch ^/rsconnect$ /rsconnect/
  RequestHeader set X-RSC-Request "%{REQUEST_SCHEME}s://%{HTTP_HOST}s%{REQUEST_URI}s"
  RewriteCond %{HTTP:Upgrade} =websocket
  RewriteRule /rsconnect/(.*) ws://172.17.0.1:3939/$1 [P,L]
  RewriteCond %{HTTP:Upgrade} !=websocket
  RewriteRule /rsconnect/(.*) http://172.17.0.1:3939/$1 [P,L]
  ProxyPass /rsconnect/ http://172.17.0.1:3939/
  ProxyPassReverse /rsconnect/ http://172.17.0.1:3939/
  Header edit Location ^/ /rsconnect/
</VirtualHost>