Azure环境下配置带SSL加密Redis的Django Channels

问题背景 #

在Azure环境配置Django应用时，使用Django Channels结合Redis实现WebSocket跟踪文件上传进度。Redis组件已启用SSL/TLS（监听6380端口），且同时为Celery提供服务。目前Celery的Redis SSL配置正常，但Channels未启用SSL，导致WebSocket通信时出现Connection reset by peer连接重置错误，尝试过GitHub上的旧配置方案无效。

错误信息 #

File "/tmp/lib/python3.10/site-packages/redis/asyncio/connection.py", line 852, in read_response
raise ConnectionError(redis.exceptions.ConnectionError: Error while reading from psm-redis.redis.cache.windows.net:6380 : (104, 'Connection reset by peer')

原无效配置 #

settings.py中的Channels初始配置 #

# PORT 6379 for NON-SSL Connection and 6380 for SSL Connection
_broker_url = f'rediss://:{os.getenv("REDIS_PASS", "")}@{os.getenv("REDIS_HOST", "localhost")}:{os.getenv("REDIS_PORT", "6379")}'
CELERY_BROKER_URL = _broker_url
CELERY_RESULT_BACKEND = _broker_url
CELERY_BROKER_USE_SSL = {'ssl_cert_reqs': ssl.CERT_REQUIRED}
CELERY_REDIS_BACKEND_USE_SSL = {'ssl_cert_reqs': ssl.CERT_REQUIRED}

CHANNEL_LAYERS = {
    "default": {
        "BACKEND": "channels_redis.core.RedisChannelLayer",
        "CONFIG": {
            "hosts": [(os.getenv("REDIS_HOST", "127.0.0.1"), int(os.getenv("REDIS_PORT", 6379)))],
        },
    },
}

尝试过的旧无效配置 #

ssl_context = ssl.SSLContext()
ssl_context.check_hostname = False

redis_ssl_host = {
    'address': _broker_url,
    'ssl_context': ssl_context
}

CHANNEL_LAYERS = {
    "default": {
        "BACKEND": "channels_redis.core.RedisChannelLayer",
        "CONFIG": {
            "hosts": (redis_ssl_host,)
        },
    },
}

正确配置方案 #

channels_redis新版本支持直接通过URL或ssl参数配置SSL连接，无需手动创建SSLContext。以下两种方式均可解决问题：

方式一：复用已有的SSL Redis URL #

直接使用Celery配置中已定义的_broker_url（rediss://开头的SSL连接URL），并可额外指定SSL验证参数：

import ssl
import os

_broker_url = f'rediss://:{os.getenv("REDIS_PASS", "")}@{os.getenv("REDIS_HOST", "localhost")}:{os.getenv("REDIS_PORT", "6380")}'
CELERY_BROKER_URL = _broker_url
CELERY_RESULT_BACKEND = _broker_url
CELERY_BROKER_USE_SSL = {'ssl_cert_reqs': ssl.CERT_REQUIRED}
CELERY_REDIS_BACKEND_USE_SSL = {'ssl_cert_reqs': ssl.CERT_REQUIRED}

CHANNEL_LAYERS = {
    "default": {
        "BACKEND": "channels_redis.core.RedisChannelLayer",
        "CONFIG": {
            "hosts": [_broker_url],
            # 可选：与Celery配置保持一致的严格证书验证
            "ssl": {"ssl_cert_reqs": ssl.CERT_REQUIRED},
        },
    },
}

方式二：手动配置主机、端口及SSL参数 #

如果不使用URL方式，可显式配置主机、端口，并通过ssl字典指定SSL验证规则：

import ssl
import os

_broker_url = f'rediss://:{os.getenv("REDIS_PASS", "")}@{os.getenv("REDIS_HOST", "localhost")}:{os.getenv("REDIS_PORT", "6380")}'
CELERY_BROKER_URL = _broker_url
CELERY_RESULT_BACKEND = _broker_url
CELERY_BROKER_USE_SSL = {'ssl_cert_reqs': ssl.CERT_REQUIRED}
CELERY_REDIS_BACKEND_USE_SSL = {'ssl_cert_reqs': ssl.CERT_REQUIRED}

CHANNEL_LAYERS = {
    "default": {
        "BACKEND": "channels_redis.core.RedisChannelLayer",
        "CONFIG": {
            "hosts": [(os.getenv("REDIS_HOST", "127.0.0.1"), int(os.getenv("REDIS_PORT", 6380)))],
            "ssl": {
                "ssl_cert_reqs": ssl.CERT_REQUIRED,
                # 可选：如果Azure Redis需要指定根证书，添加对应路径
                # "ca_certs": "/path/to/azure-root-cert.pem"
            },
        },
    },
}

注意事项 #

1. 确保安装的channels_redis版本≥3.0.0，旧版本可能不支持上述SSL配置方式
2. 确认环境变量REDIS_PORT设置为6380（SSL端口）
3. 前端使用wss://的WebSocket连接是正确的，无需修改

内容的提问来源于stack exchange，提问作者michal.kyjovsky