Re: Reverse proxy
Bret Stern <[email protected]> Tue, 7 Oct 2025 12:24:13 -0700
| Newsgroups | gmane.comp.apache.user |
|---|---|
| Message-ID | <[email protected]> |
Eliyahu, Appreciate you taking a shot. Here they are: <VirtualHost *:80> SSLProxyEngine on ServerName postfixadmin.domain.com ProxyPreserveHost On ProxyPass / http://192.168.60.157/ ProxyPassReverse / http://192.168.60.157/ </VirtualHost> <VirtualHost *:80> ServerName mail.domain.com ProxyPreserveHost On ProxyPass / http://192.168.60.157/ ProxyPassReverse / http://192.168.60.157/ </VirtualHost> By the way the WAN side server hosts 3 websites. But the mail.domain.com and the postfixadmin.domain.com are proxied to another server on the lan. I kind of feel like this setup is a bit corrupted, there's so much info out there, and who knows what the right way. My hunch is taking me to a possible ssl encryption setup, so I'm asking on letsEncrypt as well. If there's anything logs wise you need, I can provide. Appreciate your thoughts, Bret On 10/7/2025 12:07 PM, E.S. Rosenberg wrote: > > > Op di 7 okt 2025 om 18:34 schreef Bret Stern > <[email protected]>: > > Ok. So my understanding of ReWrite rules is to modify the url in > some fashion...per the Apache docs. > I don't see any reason to do that..so I commented out all the > "ReWrite directives". Good to get the junk out of > the puzzle. > > After commenting out the ReWrites, I restarted httpd. > postfixadmin.domain.com <http://postfixadmin.domain.com> is still > landing in the > mail.domain.com <http://mail.domain.com> DocumentRoot. > > Is there some sort of "debug" directive which would help me figure > out when the DocumentRoot > is getting set to what and when. > > Ideas? > > > > > First virt host config for postfixadmin > <VirtualHost *:80> > SSLProxyEngine on > ServerName postfixadmin.domain.com > <http://postfixadmin.domain.com> > ProxyPreserveHost On > ServerAlias www.postfixadmin.domain.com > <http://www.postfixadmin.domain.com> > DocumentRoot /var/www/postfixadmin/public > > <Directory /var/www/postfixadmin/public> > Options -Indexes +FollowSymLinks > AllowOverride All > </Directory> > > ErrorLog /var/log/httpd/postfixadmin-error.log > CustomLog /var/log/httpd/postfixadmin-access.log combined > #RewriteEngine on > #RewriteCond %{SERVER_NAME} =www.postfixadmin.domain.com > <http://www.postfixadmin.domain.com> [OR] > #RewriteCond %{SERVER_NAME} =postfixadmin.domain.com > <http://postfixadmin.domain.com> > #RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} > [END,NE,R=permanent] > </VirtualHost> > > second virt host config for mail > <VirtualHost *:80> > SSLProxyEngine on > ServerName mail.domain.com <http://mail.domain.com> > ProxyPreserveHost On > ServerAlias www.mail.domain.com <http://www.mail.domain.com> > DocumentRoot /var/www/html > > <Directory /var/www/html> > Options -Indexes +FollowSymLinks > AllowOverride All > </Directory> > > ErrorLog /var/log/httpd/mail-domain-error.log > CustomLog /var/log/httpd/mail-domain-access.log combined > #RewriteEngine on > #RewriteCond %{SERVER_NAME} =www.mail.domain.com > <http://www.mail.domain.com> [OR] > #RewriteCond %{SERVER_NAME} =mail.domain.com <http://mail.domain.com> > #RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} > [END,NE,R=permanent] > </VirtualHost> > > > > > > > On 10/7/2025 7:29 AM, Frank Gingras wrote: >> >> >> On Mon, Oct 6, 2025 at 5:12 PM Bret Stern >> <[email protected]> wrote: >> >> Frank, >> >> I added the original mail.domain.com <http://mail.domain.com> >> virt host conf file back and now my postfixadmin stuff has >> reverted to >> the wrong DocumentRoot and isn't working. >> >> Here are the VirtHost files. The names of the files does not >> matter correct..they can be www.domain.com.conf >> <http://www.domain.com.conf> or >> somename.conf, right? >> >> First virt host config for postfixadmin >> <VirtualHost *:80> >> SSLProxyEngine on >> ServerName postfixadmin.domain.com >> <http://postfixadmin.domain.com> >> ProxyPreserveHost On >> ServerAlias www.postfixadmin.domain.com >> <http://www.postfixadmin.domain.com> >> DocumentRoot /var/www/postfixadmin/public >> >> <Directory /var/www/postfixadmin/public> >> Options -Indexes +FollowSymLinks >> AllowOverride All >> </Directory> >> >> ErrorLog /var/log/httpd/postfixadmin-error.log >> CustomLog /var/log/httpd/postfixadmin-access.log combined >> RewriteEngine on >> RewriteCond %{SERVER_NAME} =www.postfixadmin.domain.com >> <http://www.postfixadmin.domain.com> [OR] >> RewriteCond %{SERVER_NAME} =postfixadmin.domain.com >> <http://postfixadmin.domain.com> >> RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} >> [END,NE,R=permanent] >> </VirtualHost> >> >> second virt host config for mail >> <VirtualHost *:80> >> SSLProxyEngine on >> ServerName mail.domain.com <http://mail.domain.com> >> ProxyPreserveHost On >> ServerAlias www.mail.domain.com <http://www.mail.domain.com> >> DocumentRoot /var/www/html >> >> <Directory /var/www/html> >> Options -Indexes +FollowSymLinks >> AllowOverride All >> </Directory> >> >> ErrorLog /var/log/httpd/mail-domain-error.log >> CustomLog /var/log/httpd/mail-domain-access.log combined >> RewriteEngine on >> RewriteCond %{SERVER_NAME} =www.mail.domain.com >> <http://www.mail.domain.com> [OR] >> RewriteCond %{SERVER_NAME} =mail.domain.com >> <http://mail.domain.com> >> RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} >> [END,NE,R=permanent] >> </VirtualHost> >> >> >> >> >> >> >> This is my httpd -S readout for the internal server. >> Wondering if anything here is obvious. I don't >> read this stuff enough to know. So appreciate the eyes. >> >> Not sure what's causing the "already loaded" line below. >> >> [Mon Oct 06 13:50:40.068370 2025] [so:warn] [pid 10702:tid >> 10702] AH01574: module proxy_http_module is already loaded, >> skipping >> VirtualHost configuration: >> *:80 is a NameVirtualHost >> default server mail.domain.com >> <http://mail.domain.com> >> (/etc/httpd/conf.d/mail.domain.com.conf:1) >> port 80 namevhost mail.domain.com >> <http://mail.domain.com> >> (/etc/httpd/conf.d/mail.domain.com.conf:1) >> alias www.mail.domain.com >> <http://www.mail.domain.com> >> port 80 namevhost postfixadmin.domain.com >> <http://postfixadmin.domain.com> >> (/etc/httpd/conf.d/postfixadmin.conf:1) >> alias www.postfixadmin.domain.com >> <http://www.postfixadmin.domain.com> >> *:443 is a NameVirtualHost >> default server mail.domain.com >> <http://mail.domain.com> >> (/etc/httpd/conf.d/mail.domain.com-le-ssl.conf:3) >> port 443 namevhost mail.domain.com >> <http://mail.domain.com> >> (/etc/httpd/conf.d/mail.domain.com-le-ssl.conf:3) >> alias www.mail.domain.com >> <http://www.mail.domain.com> >> port 443 namevhost postfixadmin.domain.com >> <http://postfixadmin.domain.com> >> (/etc/httpd/conf.d/postfixadmin-le-ssl.conf:3) >> alias www.postfixadmin.domain.com >> <http://www.postfixadmin.domain.com> >> port 443 namevhost 127.0.0.1 >> (/etc/httpd/conf.d/ssl.conf:40) >> ServerRoot: "/etc/httpd" >> Main DocumentRoot: "/var/www/html" >> Main ErrorLog: "/etc/httpd/logs/error_log" >> Mutex authdigest-opaque: using_defaults >> Mutex watchdog-callback: using_defaults >> Mutex proxy-balancer-shm: using_defaults >> Mutex rewrite-map: using_defaults >> Mutex ssl-stapling-refresh: using_defaults >> Mutex authdigest-client: using_defaults >> Mutex dav_fs-lockdb: using_defaults >> Mutex lua-ivm-shm: using_defaults >> Mutex ssl-stapling: using_defaults >> Mutex proxy: using_defaults >> Mutex authn-socache: using_defaults >> Mutex ssl-cache: using_defaults >> Mutex default: dir="/etc/httpd/run/" mechanism=default >> Mutex cache-socache: using_defaults >> PidFile: "/etc/httpd/run/httpd.pid" >> Define: DUMP_VHOSTS >> Define: DUMP_RUN_CFG >> User: name="apache" id=48 >> Group: name="apache" id=48 >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> On 10/6/2025 9:02 AM, Frank Gingras wrote: >>> >>> >>> On Mon, Oct 6, 2025 at 11:47 AM Bret Stern >>> <[email protected]> wrote: >>> >>> Thanks for the comment. >>> >>> I had to remove one of my virtual hosts to to get this >>> working. >>> >>> My virtual host settings were triple checked...but the >>> DocumentRoot kept reverting to the >>> wrong virtual host DocRoot. >>> >>> If the apache logic is to use the ServerName directive >>> in the [virthost *:80] as the deciding factor to set the >>> DocRoot, then either there is another >>> setting that I'm not aware of or there is a bug in the >>> logic in apache. When I have more time to >>> look, maybe it will surface. I have some other http >>> servers in our environments, so will check those results >>> as well. >>> >>> Regardless, all of this is excellent learning experience. >>> Bret >>> >>> >>> On 10/5/2025 12:08 AM, E.S. Rosenberg wrote: >>>> Hey Bret, >>>> >>>> Unless I am very much mistaken you need to use the FQDN >>>> in the ProxyPass directive and if you don't want to >>>> expose the "real" IP of server B to the Internet you >>>> would need to "override" the public DNS records either >>>> in /etc/hosts or if you have the ability to present a >>>> different DNS view to server A and don't mind that >>>> complication that would be another option. >>>> You could I guess also use some internal FQDN as long >>>> as the virtualhosts on server B know to respond to that >>>> too and all the links they return are relative or >>>> rewritten to the domain server A presents. >>>> >>>> HTH, >>>> Eliyahu - אליהו >>>> >>>> Op zo 5 okt 2025 om 09:34 schreef Bret Stern >>>> <[email protected]>: >>>> >>>> Can someone please comment. >>>> >>>> Apache server A is a physical server on my network. >>>> I has three virtual >>>> hosts serving three >>>> different websites. This appears to be working >>>> correctly. >>>> >>>> Introducing Apache server B >>>> Apache server A also acts as a reverse proxy to >>>> Apache server B which is >>>> another separate server with a static ip, and >>>> acts as my mail server. >>>> >>>> There are two virtual hosts defined on Apache >>>> server B, one is >>>> mail.domain.com <http://mail.domain.com> and one is >>>> postfixadmin.domain.com >>>> <http://postfixadmin.domain.com> >>>> >>>> My question is can Apache server A route (via >>>> reverse proxy) to the two >>>> virtual hosts on Apache server B. >>>> >>>> At this point it's close to working, but my >>>> postfixadmin.domain.com >>>> <http://postfixadmin.domain.com> is >>>> having it's document root directed to >>>> virtual host mail.domain.com >>>> <http://mail.domain.com>, instead of >>>> postfixadmin.domain.com >>>> <http://postfixadmin.domain.com> >>>> >>>> I've spent hours checking my virt host >>>> configurations. Is there some >>>> other setting outside the virtual host >>>> configuration that >>>> is allowing the DocumentRoot to be hijacked? >>>> >>>> Can someone please confirm my setup is possible? >>>> Regards >>>> >>>> >>>> >>>> >>>> --------------------------------------------------------------------- >>>> To unsubscribe, e-mail: >>>> [email protected] >>>> For additional commands, e-mail: >>>> [email protected] >>>> >>> >>> >>> You'll need to show the output from the apachectl -S command >>> on all servers get a complete answer, to start. >> >> >> The name of the config files are not relevant, indeed. >> >> That being said, your :80 vhosts make no sense. You use >> SSLProxyEngine on, yet you explicitly redirect to https:// in the >> same vhost. You have to decide if you want to proxy or redirect, >> first. > > > Hey Bret, > > Unless I am very much mistaken so far you have only shared the config > of the internal server (server B) and not the reverse proxy configs. > Based on what you are describing my suspicion is that your reverse > proxy configuration is wrong/stripping the target hostname and thus > you end up on whatever virtualhost matches by default. > > HTH, > Eliyahu - אליהו