Rails on Elastic Beanstalk, Can't do a load balancer health check

Question

I am running a rails app on elastic beanstalk, my problem is that I cannot use the load balancer health check, as it checks via http, not https. I have config.force_ssl set to true, and don't really want to change it, since it means I have 100% ssl coverage, HSTS, and secure cookies. I have setup a controller to check at /health and can access this via curl. There seems to be a contradiction between what is shown in elastic beanstalk (EC2 Instance Health Check), where I can only change the path and some timings, and the health check in the load balancer in EC2, where I can change the ping protocol, port and path to what I want, but this seems to have no effect other than causing a 503 error.

Ping Protocol: https 
Ping Port: 443 
Ping Path: /health

The load balancer has ports 80 and 443 open but redirects from 80 to 443 due to force_ssl.

Does anyone know of the correct settings to get around this, as I won't be able to scale the application without it?

Thank you

Eamon

Answer 1

The way to do this is to add this to your config, like this.

config.force_ssl
config.ssl_options = { redirect: { exclude: -> request { request.path =~ /health/ } } }

This is as per the rails docs and is valid for Rails 5:

http://api.rubyonrails.org/classes/ActionDispatch/SSL.html

Answer 2

Small hint for the accepted answer:

In case you have updated from Rails 4 to Rails 5 and have therefore a new_frameworks_default.rb in your initializers directory. You need to remove (or out-comment) the following line:

Rails.application.config.ssl_options = { hsts: { subdomains: true } }

Otherwise ssl_options is already set.

Answer 3

If, like me you are not using rails 5, the other way you can do this is to disable force SSL, and use NGINX to force all traffic onto https... You can use an ebextension file to do this. The exact version you need comes direct from AWS:

https://github.com/awslabs/elastic-beanstalk-docs/blob/master/.ebextensions/aws_provided/security%20configuration/https-redirect-ruby-puma.config

If you need more information on ebextensions, you can find them in the docs http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/ebextensions.html

EDIT : The original link no longer works...

Try this: https://github.com/awsdocs/elastic-beanstalk-samples/blob/master/configuration-files/aws-provided/security-configuration/https-redirect/ruby-puma/https-redirect-ruby-puma.config

Answer 4

The accepted answer kept not working for me, but after hours of debugging I found this gem:

https://github.com/lserman/aws-healthcheck

It returns 200 on /healthcheck which works like a charm.