Difference between revisions of "Apache Proxy"
Jump to navigation
Jump to search
Michael.mast (talk | contribs) |
Michael.mast (talk | contribs) |
||
| Line 15: | Line 15: | ||
openssl \ | openssl \ | ||
yum install certbot python2-certbot-apache | yum install certbot python2-certbot-apache | ||
| − | RUN echo -e "ServerTokens Prod\nServerSignature Off\nLoadModule deflate_module modules/mod_deflate.so" >> /etc/httpd/conf/httpd. | + | RUN echo -e "ServerTokens Prod\nServerSignature Off\nLoadModule deflate_module modules/mod_deflate.so" >> /etc/httpd/conf/httpd.conf |
RUN :> /etc/httpd/conf.d/welcome.conf | RUN :> /etc/httpd/conf.d/welcome.conf | ||
EXPOSE 80 443 | EXPOSE 80 443 | ||
Revision as of 14:39, 13 June 2019
Contents
Dockerfile Example
Sometimes I run the proxy using the default httpd container, other times I use the following centos build. Depending on how I feel that day.
- Running this will allow you to run certbot within the container.
FROM centos:latest
RUN yum -y upgrade
RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
RUN yum -y install http://rpms.remirepo.net/enterprise/remi-release-7.rpm
RUN yum -y install yum-utils
RUN yum-config-manager --enable remi-php73
RUN yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional
RUN yum -y install \
http \
mod_ssl \
openssl \
yum install certbot python2-certbot-apache
RUN echo -e "ServerTokens Prod\nServerSignature Off\nLoadModule deflate_module modules/mod_deflate.so" >> /etc/httpd/conf/httpd.conf
RUN :> /etc/httpd/conf.d/welcome.conf
EXPOSE 80 443
CMD /usr/sbin/httpd -DFOREGROUND
Certbot Letsencrypt
In this case I am trying to use webroot verification to obtain a certificate for a running site behind a proxy. This is all done using docker containers. Still working on the specifics, but one issue I am running into is that SELinux on CentOS 7 doesn't like processes from containers hitting ZFS directories created by Docker. Will need to finish migrating these containers to VMs running on the CentOS 7 host.
I digress.
- Make sure you prevent the proxy from proxying the challenge[1] by adding the following to your vhost for the domain.
ProxyPass /.well-known/ !
Alternatively
<VirtualHost *:80>
<Location "/.well-known/acme-challenge/">
allow from all
</Location>
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/(.*)$
RewriteCond %{HTTPS} off
RewriteRule ^/(.*)$ https://%{SERVER_NAME}%{REQUEST_URI}
</VirtualHost>
[2]There are two methods for running certbot with containers.
- The first option is to run a temp container and mounting the letsencrypt and web root directory.
sudo docker run --rm --name certbot -v /proxy/sitefiles:/var/www/ -v /proxy/certs/letsencrypt:/etc/letsencrypt \ certbot/certbot certonly --agree-tos -m your@email.com --webroot -w /var/www/ -d your.domain.com
- The other method is to run certbot within the live proxy container. This is not ideal as the container would need rw access to relevant directories.
docker exec -it proxy certbot certonly --agree-tos -m your@email.com --webroot -w /var/www/html/ -d your.domain.net
SSL Handshake with remote server favicon.ico
While trying to set an ssl proxy, I ran into an issue where the ssl handshake would not work with the stupid website icon.
Error during SSL Handshake with remote server returned by /favicon.ico
In this case it was ok to ignore the authenticity of the connection, restricted use case and something that I would normally not do[3]
SSLProxyEngine On SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off
Proxy vhost sample
Listen 8080 LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_connect_module modules/mod_proxy_connect.so LoadModule proxy_html_module modules/mod_proxy_html.so LoadModule proxy_ftp_module modules/mod_proxy_ftp.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so LoadModule proxy_scgi_module modules/mod_proxy_scgi.so LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so LoadModule proxy_ajp_module modules/mod_proxy_ajp.so LoadModule proxy_express_module modules/mod_proxy_express.so LoadModule rewrite_module modules/mod_rewrite.so LoadModule cache_module modules/mod_cache.so LoadModule cache_disk_module modules/mod_cache_disk.so LoadModule ssl_module modules/mod_ssl.so <IfModule cache_disk_module modules> CacheRoot "/var/cache/httpd/" CacheEnable disk / CacheDirLevels 2 CacheDirLength 1 CacheMaxFileSize 52428800 </IfModule> <VirtualHost *:8080> CustomLog logs/access_log combined ErrorLog logs/error_log <IfModule proxy_module> SSLProxyEngine On SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off ProxyPass "/" "https://michaelwiki.geekgalaxy.com/" ProxyPassReverse "/" "https://michaelwiki.geekgalaxy.com/" ProxyPreserveHost On </IfModule> </VirtualHost>
