<p>What <strong>config.action_cable.url</strong> should be configured for websockets / Rails / Kubernetes /Minukube with Nginx?</p>
<p>When running &quot;docker-compose&quot; locally an Nginx processes in front of a Rails process (not API only, but with SSR)  and a standalone Cable process (cf <a href="https://guides.rubyonrails.org/action_cable_overview.html#standalone" rel="nofollow noreferrer">the guides</a>), the websockets work fine by passing the following server-side (in say &quot;/config/application.rb&quot;, with <code>action_cable_meta_tag</code> set in the layouts):</p>
<pre class="lang-rb prettyprint-override"><code>config.action_cable.url = 'ws://localhost:28080'
</code></pre>
<p>I am targetting Kubernetes with Minikube locally:  I deployed Nginx in front of a Rails deployment (RAILS_ENV=production) along with a Cable deployment but I can't make it work. The Cable service is internal of type &quot;ClusterIP&quot;, with &quot;port&quot; and &quot;targetPort&quot;. I tried several variations.</p>
<p>Any advice?</p>
<p>Note that I use Nginx -&gt; Rails + Cable on Minikube, and the entry-point is the Nginx service, external of kind LoadBalancer where I used:</p>
<pre><code>upstream rails {
  server rails-svc:3000;
}
server {
  listen 9000 default_server;
  root /usr/share/nginx/html;
  try_files  $uri @rails;
  add_header  Cache-Control public;
  add_header  Last-Modified &quot;&quot;;
  add_header  Etag &quot;&quot;;
      

  location @rails {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header Host $http_host;
    proxy_pass_header   Set-Cookie;
    proxy_redirect off;
    proxy_pass http://rails;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection &quot;upgrade&quot;;
  }
}
</code></pre>
<p>To allow any origin, I also set:</p>
<pre class="lang-rb prettyprint-override"><code>config.action_cable.disable_request_forgery_protection = true
</code></pre>

NevD
<p>I have an answer: in a Minikube cluster, don't put anything and disable forgery protection, Rails will default the correct value. When Nginx is front of a Rails pod and a standalone ActionCable/websocket pod (the Rails image is launched with <code>bundle exec puma -p 28080 cable/config.ru</code>), if I name &quot;cable-svc&quot; the service that exposes the ActionCable container, and &quot;rails-svc&quot; the one for the Rails container, you need to:</p>
<ul>
<li>in K8, don't set the config for <code>CABLE_URI</code></li>
<li>in the Rails backend, you don't have the URL (unknown <code>127.0.0.1:some_port</code>), do:</li>
</ul>
<pre class="lang-rb prettyprint-override"><code># config.action_cable.url &lt;-- comment this
config.action_cable.disable_request_forgery_protection=true
</code></pre>
<ul>
<li>in the Nginx config, add a specific location for the &quot;/cable&quot; path:</li>
</ul>
<pre><code>upstream rails {
  server rails-svc:3000;
}
server {
  [...root, location @rails {...}]
  location /cable {
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection &quot;Upgrade&quot;;
    proxy_pass &quot;http://cable-svc:28080&quot;;
  }
}
</code></pre>
<p>Check the logs, no more WebSockets in Rails, and Cable responds.</p>
