View source for Configuring an Apache reverse proxy server with LetsEncrypt SSL certificates

<div class="mw-parser-output"><div class="mw-parser-output"><div class="mw-parser-output">
== Basic Proxying ==

Whether or not you have any experience configuring apache virtualhosts, setting up a basic proxy is a piece of cake. You’ll have to enable a couple modules on your server
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">a2enmod proxy proxy_http proxy_ajp rewrite deflate headers proxy_balancer proxy_connect proxy_html</div> 
Disable the default site
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">a2dissite 000-default</div> 
Now you can make the choice, you can either create a virtual site for each service you proxy, or put them all in a single apache site. I prefer one for each internal service, so I will create a new site configuration
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">vim /etc/apache2/sites-available/webservice-eden-localdomain.conf</div> 
Inside this site configuration, create a new virtualhost listening on port 80. For more information on configuring a virtualhost, see the&nbsp;[https://httpd.apache.org/docs/current/vhosts/examples.html apache docs.]&nbsp;There are a ton of different configuration options
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><Virtualhost *:80></div> 
Give this virtualhost a ServerName matching your target domain name
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">ServerName 'webservice.acabey.xyz'</div> 
Now the actual proxying (if you don’t use an internal DNS, just use the static IP of your server)
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">ProxyPreserveHost On&nbsp;<br/> ProxyPass / '[http://webservice.eden.localdomain/' http://webservice.eden.localdomain/']&nbsp;<br/> ProxyPassReverse / ''[http://webservice.eden.localdomain http://webservice.eden.localdomain]''</div> 
Your basic, insecure virtualhost should look something like this
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">< VirtualHost *:80 >&nbsp;<br/> ServerName 'webservice.acabey.xyz'<br/> ProxyPreserveHost On<br/> ProxyPass / '[http://webservice.eden.localdomain/' http://webservice.eden.localdomain/']<br/> ProxyPassReverse / ''[http://webservice.eden.localdomain http://webservice.eden.localdomain]''<br/> < /VirtualHost ></div> 
&nbsp;

== Internal SSL (Optional) ==

Of course, you notice that there is absolutely no SSL/TLS going on here, which is no bueno. Solid security in a reverse proxy system should look like this
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">Internet ←→ Reverse Proxy (LetsEncrypt SSL) ←→ Internal Service (self-signed SSL)</div> 
Ideally, you should set up an internal, self-signed CA that you add to all the machines on your internal network, and use a certificate signed by this CA on your internal webserver. From there, the only things you have to change are the ProxyPass directives in your virtualhost to https rather than http.

== Configuring LetsEncrypt ==

To really step up your security game, we will use LetsEncrypt to establish SSL with our internet users.

There are countless guides on how to use LetsEncrypt, but to keep it brief (assuming a Debian/ Ubuntu system)
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">apt install python-letsencrypt-apache<br/> sudo letsencrypt --apache -d webservice.acabey.xyz</div> 
In the interactive window, be sure to Allow both HTTP and HTTPS connections, we will fix this in a second. Go back into your apache site config and notice that you should now have a virtualhost listening on port 443.

&nbsp;

Before we continue with that, you should first redirect http to https. Go to the virtualhost listening on port 80 and cut your proxying directives down to the new 443 virtualhost. In place of this, just add a permanent redirect to the https enabled site
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">Redirect Permanent / [https://webservice.acabey.xyz/ https://webservice.acabey.xyz/]<br/> Remove the Alias directive</div> 
== Proxying SSL ==

Although you are very, very close, there is some magic when it comes to proxying SSL traffic. In the 443 virtualhost, add a global location section, which we will use to apply some headers
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">< Location "/" ><br/> RequestHeader set X-Forwarded-Proto https<br/> RequestHeader set X-Forwarded-Ssl on<br/> RequestHeader set X-Url-Scheme https<br/> < /Location ></div> 
Make sure that your original proxy settings are in the 443 virtualhost. By the end, your site apache site configuration should look something like this:

[[File:Reverse-proxy-config-orig.png]]
</div> </div> </div>