Re: [mh] reverse proxy issue/questions

In short, I have been doing a lot of trial and error testing and finding pieces to read on the internet.

My latest trial seemed to fix my first issue of the reverse host/location header not being https and having the :9191 port on the end.

I turned off ProxyPreserveHost and this made it work. I am almost positive I sea this was enabled when looking at the MH wiki; anyway that seems to be solved.

On to the second issue to access it from outside my firewall/internet.

I do have a proper certificate from letsencrypt and it is configured (I believe properly). My registered domain is icanbrew.net pointing to 136.57.140.198 and there is a cname for mh that point to icanbrew.net

So, mh.icanbrew.net will resolve to 136.57.140.198. I have the virtual server set up for this domain name; however traffic from the internet is not going there, it always going to the default virtual server-which looks like this:

<IfModule mod_ssl.c>
                <VirtualHost _default_:443>
                                ServerAdmin [email protected]<mailto:[email protected]>
                               ...


This is basically the default-ssl.conf file from apache's sites-available folder

Any ideas are well appreciated.

Tim
From: Timothy Spaulding
Sent: Sunday, March 20, 2022 1:24 PM
To: [email protected]
Subject: reverse proxy issue/questions

Hello All,

I hope someone is able to guide me in the right direction to get my reverse proxy up and running.  I have never really had a need/desire for it until now.

I am using Apache2 2.4.52 on a Debian 11 Bullseye server
I have proxy, ssl, and proxy_http enabled
I have a virtual server that looks like this:
<IfModule mod_ssl.c>
                <VirtualHost mh.icanbrew.net:443>
                                ServerAdmin [email protected]<mailto:[email protected]>
                                ServerName mh.icanbrew.net
#                             ServerAlias mh.icanbrew.net
                                UseCanonicalName On

                                DocumentRoot /var/www/icanbrew/mh

                                LogLevel info proxy:trace8 ssl:info

                                ErrorLog ${APACHE_LOG_DIR}/icanbrew/mh/error.log
                                CustomLog ${APACHE_LOG_DIR}/icanbrew/mh/access-https.log vhost_combined

                                SSLEngine on


                                ProxyPreserveHost On
                                ProxyRequests Off
                                ProxyPass "/" http://misterhouse.icb.net:9191/
                                ProxyPassReverse "/" http://misterhouse.icb.net:9191/
                </VirtualHost>
</IfModule>

When I connect to https://mh.icanbrew.net from a browser, I get cannot connect message.
When I connect with curl -Lkv https://mh.icanbrew.net, I get the following:

>curl -Lkv https://mh.icanbrew.net
*   Trying 192.168.1.1:443...
* Connected to mh.icanbrew.net (192.168.1.1) port 443 (#0)
* schannel: disabled automatic use of client certificate
* schannel: ALPN, offering http/1.1
* schannel: ALPN, server accepted to use http/1.1
> GET / HTTP/1.1
> Host: mh.icanbrew.net
> User-Agent: curl/7.79.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Moved Temporarily
< Date: Sun, 20 Mar 2022 17:16:32 GMT
< Server: MisterHouse
< Location: http://mh.icanbrew.net:9191/ia7
< Content-Length: 0
< Cache-Control: no-cache
<
* Connection #0 to host mh.icanbrew.net left intact
* Issue another request to this URL: 'http://mh.icanbrew.net:9191/ia7'
*   Trying 192.168.1.1:9191...
* connect to 192.168.1.1 port 9191 failed: Connection refused
* Failed to connect to mh.icanbrew.net port 9191 after 2023 ms: Connection refused
* Closing connection 1
curl: (7) Failed to connect to mh.icanbrew.net port 9191 after 2023 ms: Connection refused

The questions/issues I have are

  *   The redirect/location keyword get rewritten to http instead of https as expected in the ProxyPassReverse directive
  *   It also adds the :9191 port that my misterhouse listens on in the remap; I am under the impression that it should not do that

So far, all of this testing is from behind my firewall. My initial test from outside my firewall is that the virtual server doesn't even seem to be engaged. That will be an additional question/issue when the above works.

Thanks
Tim

________________________________________________________
To unsubscribe from this list, go to: https://lists.sourceforge.net/lists/listinfo/misterhouse-users