I originally had a single droplet running Unbuntu 16.04, nginx unicorn, and Rails. I followed the tutorial here to setup TLS with Let’s encrypt: https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04

I then wanted to create another instance of this droplet and put a load balancer in front of the 2 droplets. To do this, I followed this advice from the load balancer docs:

All of the Droplets you use with your load balancer need to have the same SSL certificate. After your setup works with one backend server, you can create an image of the first Droplet to use to create additional instances.

I then pointed my original DNS record to the load balancer’s IP, rather than the first droplet’s IP. Note that my DNS is hosted with Google Domains, not DO, not sure if that is significant.

I have my load balancer set to SSL passthrough and round robin.

I am seeing 2 issues now:

1. A large majority of my requests are going to the first droplet (as per tailing the nginx access logs), rather than being equally distributed between the two. I am testing this by rapidly sending requests with Postman and Swagger.

2. For the 2nd droplet, I’m getting only 504 bad gateway errors. Specifically:

==> error.log <==
2019/08/16 00:41:49 [error] 14126#14126: *243 connect() to unix:/home/gc-portal/app/shared/unicorn.sock failed (111: Connection refused) while connecting to upstream, client: 167.71.106.89, server: my.domain.io, request: "POST /v2/recipes HTTP/1.1", upstream: "http://unix:/home/gc-portal/app/shared/unicorn.sock:/v2/recipes", host: "my.domain.io"

My nginx conf for this app looks like this. Note though, that the nginx conf and the unicorn conf for both droplets is identical, since I cloned the first one.

Nginx conf:

upstream gc-portal {
        server unix:/home/gc-portal/app/shared/unicorn.sock fail_timeout=0;
}

server {
        server_name my.domain.io;

        root /home/gc-portal/app/current/public;

        location /assets/  {
                gzip_static on; # serve pre-gzipped version
                expires 1M;
                add_header Cache-Control public;
        }

        location / {
                try_files $uri @app;
        }

        location @app {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header Host $http_host;
                proxy_redirect off;
                proxy_pass http://gc-portal;
        }

     #   location /pubsub {
     #proxy_pass http://gc-portal/pubsub;
     #proxy_http_version 1.1;
     #proxy_set_header Upgrade websocket;
     #proxy_set_header Connection Upgrade;
     #proxy_set_header X-Real-IP $remote_addr;
     #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     #proxy_set_header Host $http_host;
    #}

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/my.domain.io/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/my.domain.io/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = my.domain.io) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        server_name my.domain.io;
    return 404; # managed by Certbot


}

Any thoughts on what the issue might be here?