Re: [mh] reverse proxy issue/questions

Tim - I use basically the same setup as yours though mine is on SuSe, 
and I use a cname publicly on my domain like you. I share my SSL cert 
config amongst a number of SSL Vhosts as it's messy to maintain several 
the same on a wildcard otherwise. I've used CACERT forever so no info on 
Letsencrypt, but I doubt that's your problem.

My Vhost config is below, I use 7992 locally, like your 9191. Also added 
Apache auth password as I'm not convinced by mh auth mechanisms, not on 
the www anyway. I once tried to not use a vhost and put mh in a tree 
with other stuff to avoid wildcard certs and the added complexity, but 
that was a world of hell I don't recommend.  The config below is simple 
and been stable for a decade, only update Apache 2.2 - 2.4 needed minor 
changes.

To get it working "properly" - i.e. to use the same URL locally and 
remotely the other side of the firewall, you might need split horizon 
DNS - basically resolve it differently from inside and outside, that's 
another subject... But you don't need another cert - SSL doesn't care 
about the actual IP.

Or you can cheat and have another vhost config for port 80 
locally/privately with no password as I do.

ServerAlias mh.*

# Now common shared SSL configs

<IfModule mod_ssl.c>

      SSLEngine On

</IfModule>

<IfModule mod_nss.c>

      NSSEngine On

      NSSNickname keynet

</IfModule>

<IfModule mod_headers.c>

      Header append X-FRAME-OPTIONS "SAMEORIGIN"

</IfModule>

ProxyRequests Off

ProxyPass / http://localhost:7992/

ProxyPassReverse / http://localhost:7992/

ErrorLog /var/log/apache2/mh-error.log

HostnameLookups Off

UseCanonicalName Off

ServerName mh.<yourdomain.com>

<Location />

      #2.4            Deny from all

      AuthUserFile /etc/apache2/pass

      AuthType Basic

      #               AuthType OpenID

      AuthName MH

      #2.4            Satisfy Any

      Require valid-user

</Location>


On 20/03/2022 19:48, Timothy Spaulding wrote:
>
> In short, I have been doing a lot of trial and error testing and 
> finding pieces to read on the internet.
>
> My latest trial seemed to fix my first issue of the reverse 
> host/location header not being https and having the :9191 port on the end.
>
> I turned off ProxyPreserveHost and this made it work. I am almost 
> positive I sea this was enabled when looking at the MH wiki; anyway 
> that seems to be solved.
>
> On to the second issue to access it from outside my firewall/internet.
>
> I do have a proper certificate from letsencrypt and it is configured 
> (I believe properly). My registered domain is icanbrew.net pointing to 
> 136.57.140.198 and there is a cname for mh that point to icanbrew.net
>
> So, mh.icanbrew.net will resolve to 136.57.140.198. I have the virtual 
> server set up for this domain name; however traffic from the internet 
> is not going there, it always going to the default virtual 
> server—which looks like this:
>
> <IfModule mod_ssl.c>
>
>                 <VirtualHost _/default/_:443>
>
>                                 ServerAdmin [email protected] 
> <mailto:[email protected]>
>
>                                …
>
> This is basically the default-ssl.conf file from apache’s 
> sites-available folder
>
> Any ideas are well appreciated.
>
> Tim
>
>


________________________________________________________
To unsubscribe from this list, go to: https://lists.sourceforge.net/lists/listinfo/misterhouse-users