I have an docker which exposes a caddy webserver on ports 8080 and 8443 mapped to 80 and 443 respectively.
I can access it with a local browser using https://localhost:8443, however, the browser will first complain that the SSL certificate is self signed. For unknown reasons, when attempting to access using http://localhost:8080, the browser redirects https://localhost (https but without the port).
[michael@localhost api-platform]$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b4f9c942d02f api-platform_caddy "caddy run --config …" 22 minutes ago Up 22 minutes 2019/tcp, 0.0.0.0:8080->80/tcp, :::8080->80/tcp, 0.0.0.0:8443->443/tcp, 0.0.0.0:8443->443/udp, :::8443->443/tcp, :::8443->443/udp api-platform_caddy_1
120471adcb43 api-platform_php "docker-entrypoint p…" 22 minutes ago Up 22 minutes (healthy) 9000/tcp api-platform_php_1
4ab23f9bd5d9 postgres:13-alpine "docker-entrypoint.s…" 22 minutes ago Up 22 minutes 0.0.0.0:5433->5432/tcp, :::5433->5432/tcp api-platform_database_1
958944520bd5 api-platform_pwa "docker-entrypoint.s…" 22 minutes ago Up 22 minutes 3000/tcp api-platform_pwa_1
[michael@localhost api-platform]$
I wish to access the docker's webserver from a another machine. I have attempted the following, however, if there is a better way than my attempt to using the host's Apache webserver, I am fully open to changing the approach.
I have tried two versions (see below for both virtualhost config files). Similar to when using without having Apache involved, http://api-platform.example.com:80 redirects to https.
Pass the request to http://127.0.0.1:8080. Same behavior on either the local machine using https://localhost or a remote machine using https://api-platform.example.com/ and the browser displays "Client sent an HTTP request to an HTTPS server". Docker logs are silent and Apache does not log errors, however, Apache's logs access:
127.0.0.1 - - [05/Sep/2021:10:18:32 -0700] "GET / HTTP/1.1" 400 48 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0" (localhost)
11.22.33.44 - - [05/Sep/2021:10:34:18 -0700] "GET / HTTP/1.1" 400 48 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36" (remote)
Pass the request https://127.0.0.1:8443. For localhost, works as desired except browser complains first about self signed signatures, but for remote access, the browser displays The proxy server received an invalid response from an upstream server and Apache's access and error logs are displayed below.
11.22.33.44 - - [05/Sep/2021:10:29:10 -0700] "GET / HTTP/1.1" 502 341 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"
11.22.33.44 - - [05/Sep/2021:10:29:10 -0700] "GET /favicon.ico HTTP/1.1" 200 - "https://api-platform.example.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"
11.22.33.44 - - [05/Sep/2021:10:29:10 -0700] "GET /favicon.ico HTTP/1.1" 502 341 "https://api-platform.example.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"
[Sun Sep 05 10:29:30.461504 2021] [proxy_http:error] [pid 111778:tid 140510476093184] (103)Software caused connection abort: [client 11.22.33.44:53690] AH01102: error reading status line from remote server 127.0.0.1:8443
[Sun Sep 05 10:29:30.461535 2021] [proxy:error] [pid 111778:tid 140510476093184] [client 11.22.33.44:53690] AH00898: Error reading from remote server returned by /
[Sun Sep 05 10:29:30.481675 2021] [proxy_http:error] [pid 111778:tid 140510240954112] (103)Software caused connection abort: [client 11.22.33.44:53690] AH01102: error reading status line from remote server 127.0.0.1:8443, referer: https://api-platform.example.com/
[Sun Sep 05 10:29:30.483998 2021] [proxy_http:error] [pid 111778:tid 140510257739520] (103)Software caused connection abort: [client 11.22.33.44:59869] AH01102: error reading status line from remote server 127.0.0.1:8443, referer: https://api-platform.example.com/
[Sun Sep 05 10:29:30.484012 2021] [proxy:error] [pid 111778:tid 140510257739520] [client 11.22.33.44:59869] AH00898: Error reading from remote server returned by /favicon.ico, referer: https://api-platform.example.com/
Firewall settings are shown at the bottom of this post. How should one allow an HTTP server to be accessed remotely.
Virtual Host Config Files:
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName api-platform.example.com
ProxyPreserveHost On
ProxyRequests off
ProxyPass / http://127.0.0.1:8080/
ProxyPassReverse / http://127.0.0.1:8080/
ErrorLog /var/log/httpd/api-platform.example.com-error.log
CustomLog /var/log/httpd/api-platform.example.com-access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/testing.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/testing.example.com/privkey.pem
</VirtualHost>
</IfModule>
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName api-platform.example.com
ProxyPreserveHost On
ProxyRequests off
SSLProxyEngine On
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerExpire off
SSLProxyCheckPeerName off
ProxyPass / https://127.0.0.1:8443/
ProxyPassReverse / https://127.0.0.1:8443/
ErrorLog /var/log/httpd/api-platform.example.com-error.log
CustomLog /var/log/httpd/api-platform.example.com-access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/testing.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/testing.example.com/privkey.pem
</VirtualHost>
</IfModule>
firewall settings
[michael@localhost api-platform]$ sudo firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: enp0s31f6 wlp0s20f3
sources:
services: cockpit dhcpv6-client ssh
ports: 80/tcp 443/tcp 8080/tcp 8443/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[michael@localhost api-platform]$
