Gigalixir config not supporting SSL?

vrod

I have Phoenix app what still has some trouble with SSL. From Using Mix — GIGALIXIR 1.4.0 documentation I try using that config, but I observe the following behaviours:

http://myapp.com --> redirects to https://www.myapp.com  ok
http://www.myapp.com --> redirects to https://www.myapp.com ok
https://www.myapp.com --> works ok no redirect
https://myapp.com --> Potential Security Risk ahead!!!

The domain is DNSed at GoDaddy. The domain has “forwarding” to http://www.myapp.com but I am not sure what this means. I add CNAME to gigalixir for www and root domain:

gigalixir domains:add www.myapp.com
gigalixir domains:add myapp.com

But GoDaddy does not permit root level CNAME. I think this is problem?

Also I am not understanding why does the example config say port 443? Am I understanding this correctly that Gigalixir listens on PORT? So why does the example config say 443 and both http and port 443?

config :my_app, MyAppWeb.Endpoint,
  http: [port: {:system, "PORT"}], # Possibly not needed, but doesn't hurt
  url: [host: "${APP_NAME}.gigalixirapp.com", port: 443],
  secret_key_base: Map.fetch!(System.get_env(), "SECRET_KEY_BASE"),
  server: true

The DNS also uses A record, but I think this is incorrect.

Is it possible to get HTTPS for both www and root level domain with GoDaddy? Or do I need to find DNS with ALIAS feature? Is there something wrong with my config copied from example doc?

Many thanks!

13 comments

/phoenix #ssl #gigalixir

0 2763 13

2020-08-12 18:10:17 UTC

Showing Posts 1 to 10

Show Best Posts
Show All (oldest first)
Show All (newest first)

unsek

I ran into this issue in the past as well. This might not be helpful but I just transferred the domain to NameCheap and set the value to @ for root level domain.

Post #1

mgwidmann

I don’t have it configured with a custom domain but mine works fine with the standard given name. Doesn’t your url configuration have to be the custom domain name, not the gigalixirapp.com name?

App here:
https://options-tracker.gigalixirapp.com/
Code here:
https://github.com/mgwidmann/options_tracker/

Post #2

vrod

Thank you but my configuration still does not work I think. When custom domain is added, there is no example in the documentations for what the config must be. Is gigalixir domains:add alone enough?

I am still confused. From previous post, I am understanding that Gigalixir forwards requests and our apps must only listen on PORT… but why do some examples also listen on 443? I feel that this example of custom domain configuration is very much missing from the doc page or maybe I cannot find it?

also maybe GoDaddy is not possible to use with Gigalixir for custom domains?

Post #3

LostKobrakai

config :bob_versions_web, BobVersionsWeb.Endpoint,
  http: [:inet6, port: System.get_env("PORT") || 4000],
  url: [scheme: "https", port: 443],
  force_ssl: [rewrite_on: [:x_forwarded_proto], host: nil],
  …

This one works for me with the internal as well as a custom domain.

Post #4

vrod

Thank you, I tried this confi but still I have security warnings when I try https requests for the root domain:

both www and root domains are defined in gigalixir.

Post #5

LostKobrakai

Can you look at the served certificate if it actually holds your domain names?

Post #6

vrod

I think I found a clue. The trailing slash seems to be very important! At least with Firefox. Chrome seems to have problems with or without:

https://myapp.com --> redirects to https://www.myapp.com OK
https://myapp.com/ --> redirects to https://myapp.com  Warning: Potential Security Risk Ahead!!!

The certificate seems Ok for www.myapp.com – it says Let’s Encrypt and for “Subject Alt Names” it shows www.myapp.com

But when I get the “Security Risk” error, I inspect the cert and I see that Common Name

and the DNS names are for shortener.secureserver.net

Maybe this is the GoDaddy “redirect”?

Post #7

vrod

I removed the GoDaddy forwarding (it forwarded http://myapp.com to http://www.myapp.com) and now I get a new error when I request https://myapp.com → PR_END_OF_FILE_ERROR

Post #8