1

Using Debian 10 with Apache 2.4

I have a server running a few VMs. I'd like to have them accessible from the web but I would like to use only one domain name and one free SSL cert (not a pricey wildcard cert), and use the right half of the URL string (the part after the ".com") to differentiate which IP it should map to.

From what I understand, a Reverse Proxy is capable of making that happen. However, when I attempt to set it up, it fails, and I get a 404 page not found error when I go to https://mydomain.com/nextcloud or https://mydomain.com/rocketchat

If I go to the root level (https://mydomain.com) I get the index page from /var/www/html/. So the Reverse Proxy is having no effect.

So, my question is: How do I code the default-ssl.conf file to make this work?

I've tried stuff like this:

ProxyPreserveHost On
ProxyPass         /rocketchat/         http://192.168.1.33:3000/
ProxyPassReverse  /rocketchat/         http://192.168.1.33:3000/

ProxyPass         /nextcloud/     http://192.168.1.16/nextcloud/
ProxyPassReverse  /nextcloud/     http://192.168.1.16/nextcloud/

An example of what I want to happen:

If I go to https://mydomain.com/nextcloud then it connects me to 192.168.1.16.

If I go to https://mydomain.com/rocketchat then it connects me to 192.168.1.33:3000


I attempted to draw out my problem. Hopefully this graphic will help consolidate what I want:

Diagram


EDIT: Apache error log (the v61.local machine is the rocketchat machine):

[Tue Apr 27 17:23:44.975875 2021] [ssl:error] [pid 22473] [remote 192.168.1.16:443] AH01961: SSL Proxy requested for v61.local:443 but not enabled [Hint: SSLProxyEngine]
[Tue Apr 27 17:23:44.976000 2021] [proxy:error] [pid 22473] AH00961: HTTPS: failed to enable ssl support for 192.168.1.16:443 (192.168.1.16)
[Tue Apr 27 17:27:16.346092 2021] [mpm_prefork:notice] [pid 22340] AH00169: caught SIGTERM, shutting down
[Tue Apr 27 17:27:16.488467 2021] [ssl:warn] [pid 22634] AH01909: v61.local:443:0 server certificate does NOT include an ID which matches the server name
[Tue Apr 27 17:27:16.577206 2021] [ssl:warn] [pid 22636] AH01909: v61.local:443:0 server certificate does NOT include an ID which matches the server name
[Tue Apr 27 17:27:16.587100 2021] [mpm_prefork:notice] [pid 22636] AH00163: Apache/2.4.38 (Debian) OpenSSL/1.1.1d configured -- resuming normal operations
[Tue Apr 27 17:27:16.587260 2021] [core:notice] [pid 22636] AH00094: Command line: '/usr/sbin/apache2'
[Tue Apr 27 17:27:39.035976 2021] [mpm_prefork:notice] [pid 22636] AH00169: caught SIGTERM, shutting down
[Tue Apr 27 17:27:39.165342 2021] [ssl:warn] [pid 22653] AH01909: v61.local:443:0 server certificate does NOT include an ID which matches the server name
[Tue Apr 27 17:27:39.269657 2021] [ssl:warn] [pid 22655] AH01909: v61.local:443:0 server certificate does NOT include an ID which matches the server name
[Tue Apr 27 17:27:39.286080 2021] [mpm_prefork:notice] [pid 22655] AH00163: Apache/2.4.38 (Debian) OpenSSL/1.1.1d configured -- resuming normal operations
[Tue Apr 27 17:27:39.286292 2021] [core:notice] [pid 22655] AH00094: Command line: '/usr/sbin/apache2'
[Tue Apr 27 17:27:44.967985 2021] [ssl:error] [pid 22656] [remote 192.168.1.16:443] AH01961: SSL Proxy requested for v61.local:443 but not enabled [Hint: SSLProxyEngine]
[Tue Apr 27 17:27:44.968100 2021] [proxy:error] [pid 22656] AH00961: HTTPS: failed to enable ssl support for 192.168.1.16:443 (192.168.1.16)
[Tue Apr 27 17:27:47.329941 2021] [ssl:error] [pid 22657] [remote 192.168.1.16:443] AH01961: SSL Proxy requested for v61.local:443 but not enabled [Hint: SSLProxyEngine]

7
  • 1
    I updated the post with details on "fails". Thanks.
    – Benthink
    Apr 27 at 20:30
  • By the way you do know that LetsEncrypt offers wildcard certificates...?
    – roaima
    Apr 27 at 22:11
  • No, I didn't. I guess I should look into that.
    – Benthink
    Apr 27 at 22:15
  • @Benthink It looks like you need SSLProxyEngine on for a SSL-enabled backend.
    – Freddy
    Apr 27 at 22:19
  • I just added SSLProxyEngine On to my .conf file, restarted apache, but it did not have an effect.
    – Benthink
    Apr 27 at 22:24
2

You're almost there. You're testing with https://mydomain.com/nextcloud but you need to test with https://mydomain.com/nextcloud/ (note the trailing slash).

The reason for this is that because there's no /var/www/html/nextcloud directory the automatic "let's append a trailing slash to handle a directory" code doesn't fire and instead you get the 404.

Once you've got https://mydomain.com/nextcloud/ working, you need a rule to redirect https://mydomain.com/nextcloud to https://mydomain.com/nextcloud/ (create the directory nextcloud or use a Redirect; it shouldn't really matter, except that Redirect is probably the cleaner solution).

13
  • OK, I never knew about the trailing slash thing. Now I'm getting a 500 Internal Server Error page on /nextcloud/ and a blank page for /rocketchat/.
    – Benthink
    Apr 27 at 20:53
  • Also, I updated the .conf code above. I added the "/nextcloud/" part after the IP.
    – Benthink
    Apr 27 at 20:55
  • What do your Apache logs report for the ISE?
    – roaima
    Apr 27 at 21:14
  • Also, if you create a directory nextcloud containing a minimal index.html, and then go to https://mydomain.com/nextcloud/, do you still get your ISE or do you get delivered the minimal web page you just created?
    – roaima
    Apr 27 at 21:17
  • 1
    There's your problem - you're not using default-ssl.conf. If you were then your minimal web page would have been delivered when you went to https://mydomain.com/nextcloud/. Fix that before going any further
    – roaima
    Apr 27 at 23:08
2

Apache's configuration will be highly dependent on the web application being proxied. You may need additional directives if the webapp uses websockets, for instance, something that is pretty common nowadays. In addition, many webapps don't support running from a directory path inside the HTTP host and implicitly assume they have the whole root path / for themselves. Running such an application from a path, say /webapp, would require a good deal of understanding about the webapp's internals plus some carefully crafted Apache rewrite rules.

I happen to know, however, that nextcloud does support such a setup. Although you do need to configure nextcloud itself accordingly. I can't say anything about rocketchat. There is no general configuration that will work with any web application. I'm afraid you'll have to look up the documentation for each one of your webapps. And even then, you may run into some unexpected behavior if the application was designed to be deployed in a whole (sub)domain.

That being said, I feel I should strongly discorage you from running complex applications such as nextcloud and rocketchat from paths inside the same (sub)domain. Because of defaults in same-origin policy, these applications may end up having access to each other resources, including (possibly) authentication cookies, which is a big security concern.

Wildcard certificates are not "pricey". In fact, they are completely free with Let's Encrypt (DNS-01 challenge), provided you own your domain and have control over your DNS records.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.