1

I have an docker which exposes a caddy webserver on ports 8080 and 8443 mapped to 80 and 443 respectively.

I can access it with a local browser using https://localhost:8443, however, the browser will first complain that the SSL certificate is self signed. For unknown reasons, when attempting to access using http://localhost:8080, the browser redirects https://localhost (https but without the port).

[michael@localhost api-platform]$ docker ps
CONTAINER ID   IMAGE                COMMAND                  CREATED          STATUS                    PORTS                                                                                                                               NAMES
b4f9c942d02f   api-platform_caddy   "caddy run --config …"   22 minutes ago   Up 22 minutes             2019/tcp, 0.0.0.0:8080->80/tcp, :::8080->80/tcp, 0.0.0.0:8443->443/tcp, 0.0.0.0:8443->443/udp, :::8443->443/tcp, :::8443->443/udp   api-platform_caddy_1
120471adcb43   api-platform_php     "docker-entrypoint p…"   22 minutes ago   Up 22 minutes (healthy)   9000/tcp                                                                                                                            api-platform_php_1
4ab23f9bd5d9   postgres:13-alpine   "docker-entrypoint.s…"   22 minutes ago   Up 22 minutes             0.0.0.0:5433->5432/tcp, :::5433->5432/tcp                                                                                           api-platform_database_1
958944520bd5   api-platform_pwa     "docker-entrypoint.s…"   22 minutes ago   Up 22 minutes             3000/tcp                                                                                                                            api-platform_pwa_1
[michael@localhost api-platform]$

I wish to access the docker's webserver from a another machine. I have attempted the following, however, if there is a better way than my attempt to using the host's Apache webserver, I am fully open to changing the approach.

I have tried two versions (see below for both virtualhost config files). Similar to when using without having Apache involved, http://api-platform.example.com:80 redirects to https.

Pass the request to http://127.0.0.1:8080. Same behavior on either the local machine using https://localhost or a remote machine using https://api-platform.example.com/ and the browser displays "Client sent an HTTP request to an HTTPS server". Docker logs are silent and Apache does not log errors, however, Apache's logs access:

127.0.0.1 - - [05/Sep/2021:10:18:32 -0700] "GET / HTTP/1.1" 400 48 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0" (localhost)
11.22.33.44 - - [05/Sep/2021:10:34:18 -0700] "GET / HTTP/1.1" 400 48 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36" (remote)

Pass the request https://127.0.0.1:8443. For localhost, works as desired except browser complains first about self signed signatures, but for remote access, the browser displays The proxy server received an invalid response from an upstream server and Apache's access and error logs are displayed below.

11.22.33.44 - - [05/Sep/2021:10:29:10 -0700] "GET / HTTP/1.1" 502 341 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"
11.22.33.44 - - [05/Sep/2021:10:29:10 -0700] "GET /favicon.ico HTTP/1.1" 200 - "https://api-platform.example.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"
11.22.33.44 - - [05/Sep/2021:10:29:10 -0700] "GET /favicon.ico HTTP/1.1" 502 341 "https://api-platform.example.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"


[Sun Sep 05 10:29:30.461504 2021] [proxy_http:error] [pid 111778:tid 140510476093184] (103)Software caused connection abort: [client 11.22.33.44:53690] AH01102: error reading status line from remote server 127.0.0.1:8443
[Sun Sep 05 10:29:30.461535 2021] [proxy:error] [pid 111778:tid 140510476093184] [client 11.22.33.44:53690] AH00898: Error reading from remote server returned by /
[Sun Sep 05 10:29:30.481675 2021] [proxy_http:error] [pid 111778:tid 140510240954112] (103)Software caused connection abort: [client 11.22.33.44:53690] AH01102: error reading status line from remote server 127.0.0.1:8443, referer: https://api-platform.example.com/
[Sun Sep 05 10:29:30.483998 2021] [proxy_http:error] [pid 111778:tid 140510257739520] (103)Software caused connection abort: [client 11.22.33.44:59869] AH01102: error reading status line from remote server 127.0.0.1:8443, referer: https://api-platform.example.com/
[Sun Sep 05 10:29:30.484012 2021] [proxy:error] [pid 111778:tid 140510257739520] [client 11.22.33.44:59869] AH00898: Error reading from remote server returned by /favicon.ico, referer: https://api-platform.example.com/

Firewall settings are shown at the bottom of this post. How should one allow an HTTP server to be accessed remotely.

Virtual Host Config Files:

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName api-platform.example.com
    ProxyPreserveHost On
    ProxyRequests off
    ProxyPass / http://127.0.0.1:8080/
    ProxyPassReverse / http://127.0.0.1:8080/
    ErrorLog /var/log/httpd/api-platform.example.com-error.log
    CustomLog /var/log/httpd/api-platform.example.com-access.log combined
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/testing.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/testing.example.com/privkey.pem
</VirtualHost>
</IfModule>


<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName api-platform.example.com
    ProxyPreserveHost On
    ProxyRequests off
    SSLProxyEngine On
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerExpire off
    SSLProxyCheckPeerName off
    ProxyPass / https://127.0.0.1:8443/
    ProxyPassReverse / https://127.0.0.1:8443/
    ErrorLog /var/log/httpd/api-platform.example.com-error.log
    CustomLog /var/log/httpd/api-platform.example.com-access.log combined
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/testing.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/testing.example.com/privkey.pem
</VirtualHost>
</IfModule>

firewall settings

[michael@localhost api-platform]$ sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp0s31f6 wlp0s20f3
  sources:
  services: cockpit dhcpv6-client ssh
  ports: 80/tcp 443/tcp 8080/tcp 8443/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
[michael@localhost api-platform]$
2
  • I just edited to make the fire-wall settings a section. Look how I used 3-single-back-quotes, on a line of their own at start and end of code, and a heading. I also upvoted. Hope someone can help. Commented Sep 8, 2021 at 7:33
  • @ctrl-alt-delor Appreciate. I finally got things somewhat working but don't know why and then they stopped working. I am trying to get more info why. Apache's logs just state error reading status which is not much to go on. Possible to make Apache give more? docker logs gives nothing. I then tried to access caddy's logs inside the docker but /var/log is empty. Any thoughts? Thanks Commented Sep 8, 2021 at 14:24

1 Answer 1

0

You don't need a web-server on the host. I suspect that it may be the file-wall on the host. It maybe blocking the ports.

1
  • Don't think a firewall issue (added firewall-cmd --list-all to original post and I am getting httpd log). Also, agree I don't need a web-server on the host but it is already there and wanted to keep it with 80/443 and thus needed to change the docks published ports. When not https, I understand why I get the Client sent an HTTP request to an HTTPS server error, but I don't understand the proxy error and think I just messed up its virtual host file (does it look okay?). Thanks Commented Sep 6, 2021 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .