Re: [Pound Mailing List] Pound installed, unable to redirect as I want...

Hi Alexander,

sorry for the late answer. Your answer helped me to find the good solution.
And I want to thank all those of you who work to develop pound.

I give here all the results of my reseaches... I hope it may help someone.


regards,

Christian COMMARMOND


I will also advertize two websites and people whom I find the information
very usefull, It may help others:
https://help.ubuntu.com/community/Pound                           For a
working example of pound configuration
http://arthurguru.users.sourceforge.net/blog/pound.html         For scripts
to automatize pound as a service
https://secwise.nl/lets-encrypt-certifcates-and-pound-load-balancer/
Which helps to deploy SSL using let's encrypt quite easily

Using pmwiki and wordpress, I had to do this to make it work:
pmwiki:
in the config.php file; uncomment the lines 14 and 15 and make them looks
like these (don't change the $_SERVER['HTTP_HOST'].):
$ScriptUrl = "https://".$_SERVER['HTTP_HOST']."/pmwiki/pmwiki.php";
$PubDirUrl = 'https://'.$_SERVER['HTTP_HOST'].'/pmwiki/pub';

wordpress:
add the following lines in wp-config.php just before the last command
/** try to define WP with SSL */
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
       $_SERVER['HTTPS']='on';
and modify the configuration page to use https...


My present files pound.cfg, init.d script and lets encrypt script:
pound.cfg:
###################################
#### Calomel.org  Pound.conf   BEGIN
####################################
# Author C.COMMARMOND
# 20161111
User        "pound"
Group       "pound"
LogFacility daemon
LogLevel    3
Alive       30
Client      10
TimeOut     10
Grace       10

# http://www.mywebsite.com/*   is redirected to https://www.mywebsite.com/...
Documentation states that my version (2.7f) should have RedirectAppend, but
it does not
# So I should rather redirect to a static page saying that this domain is
100% HTTPS... Not very good.

# https://www.mywebsite.com/
#                           wiki      is redirected to pmwiki on
192.168.11.129 port 80
#                           customer  is redirected to an oracle web server
on 192.168.11.114 port 8080
#                           images    is redirected to pmwiki on
192.168.11.129 port 80 (but can be http)
#                           wp        is redirected to wordpress on
192.168.11.132 port 80
#                           othersite is redirected to another (external)
site on 10.10.10.10 port 80 so it will be SSLed by our pound



ListenHTTPS
# My internal address for pound HTTPS (443) is NATed to 8443 to allow local
443 to be available
     Address 192.168.11.146
     Port    8443
     Cert    "/etc/pound/certs/www.mywebsite.com"

#   CheckURL   "(^\/|\.html|\.css|\.jpg|favicon\.ico|robots\.txt|\.png)$"
    HeadRemove "X-Forwarded-For"
# AddHeader needed for wordpress
    AddHeader  "X-Forwarded-Proto: https"
#   If you put MaxRequest, things like pmwiki and wordpress will not work
if you create pages bigger than a few hundred chrs
#   MaxRequest 1024
   xHTTP       2

# Generic error pages
   Err414 "/var/www/htdocs/error/generic_error_page"
   Err500 "/var/www/htdocs/error/generic_error_page"
   Err501 "/var/www/htdocs/error/generic_error_page"
   Err503 "/var/www/htdocs/error/generic_error_page"


# Static data from the server serving pmwiki (for now, only some images)
   Service
      HeadRequire "Host:*.www.mywebsite.com.*"
      URL         "^\/images\/*"
      BackEnd
         Address  192.168.11.129
         Port     80
      End
   End


# An other website served by an Oracle webserver with a basename of
customer ( www.mywebsite.com/customer/...) served on port 8080
   Service
      HeadRequire "Host:*.www.mywebsite.com.*"
      URL         "^\/customer\/*"
      BackEnd
         Address  192.168.11.114
         Port     8080
      End
   End

# PmWiki server
   Service
      HeadRequire "Host:*.www.mywebsite.com.*"
      URL         "^\/wiki\/*"
      BackEnd
         Address  192.168.11.129
         Port     80
      End
   End

# Wordpress server
   Service
      HeadRequire "Host:*.www.mywebsite.com.*"
      URL         "^\/wp\/*"
      BackEnd
         Address  192.168.11.132
         Port     80
      End
   End

# A remote server located in another city (note that this website will be
https encoded by this server... crazy...
   Service
      HeadRequire "Host:*.www.mywebsite.com.*"
      URL         "^\/othersite\/*"
      BackEnd
         Address  10.10.10.10
         Port     80
      End
  End

End

ListenHTTP
# My internal address for pound
   Address    192.168.11.146
   Port       8081
#   CheckURL   "(^\/|\.html|\.css|\.jpg|favicon\.ico|robots\.txt|\.png)$"
   HeadRemove "X-Forwarded-For"
#   MaxRequest 1024
   xHTTP       2

   Err414 "/var/www/htdocs/error/generic_error_page"
   Err500 "/var/www/htdocs/error/generic_error_page"
   Err501 "/var/www/htdocs/error/generic_error_page"
   Err503 "/var/www/htdocs/error/generic_error_page"


# Needed for letsEncrypt certificate generation (even if finally I did not
see it used and the certificates have been created)
    Service
        URL "/.well-known/acme-challenge/.*"
        BackEnd
            Address 127.0.0.1
            Port 8000
        End
   End

# Static data from server pmwiki (we serve them in http too)
   Service
#      CheckURL   "(^\/wp\/*)$"
      HeadRequire "Host:*.www.mywebsite.com.*"
      URL         "^\/images\/*"
      BackEnd
         Address  192.168.11.129
         Port     80
      End
   End

# wiki, wordpress et the other site are redirected to https
   Service "www.mywebsite.com"
# It should be RedirectAppend, but even if I have last version,
RedirectAppend does not work
       Redirect "https://www.mywebsite.com"
   End

End

####################################
#### Calomel.org  Pound.conf     END
####################################



The /etc/init.d/pound to manage pound as a service (it is not from me...):
pound:
#!/bin/bash
#
# pound         This shell script starts the Pound load-balancer
#
# Author:       Arthur Gouros
#
# chkconfig: - 85 15
#
# description:  Pound is a reverse proxy and load-balancer
# processname:  pound
# config: /etc/pound.d/prod.conf
# pidfile: /var/run/pound-prod.pid
#

# source function library
. /etc/rc.d/init.d/functions

RETVAL=0

###############################
# Custom options for production
###############################
servicename="pound"
options="-f /etc/pound.cfg -p /var/run/pound.pid"
lockfile=/var/lock/subsys/pound

start() {
        echo -n $"Starting Pound $servicename: "
        daemon pound $options
        RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && touch $lockfile
}

stop() {
        echo -n $"Stopping Pound $servicename: "
        killproc $servicename
        echo
        [ $RETVAL -eq 0 ] && rm -f $lockfile
}

restart() {
        stop
        start
}

case "$1" in
  start)
        start
        ;;
  stop)
        stop
        ;;
  restart|force-reload|reload)
        restart
        ;;
  condrestart)
        [ -f $lockfile ] && restart
        ;;
  status)
        status $servicename
        RETVAL=$?
        ;;
  *)
        echo $"Usage: $0
{start|stop|status|restart|reload|force-reload|condrestart}"
        exit 1
esac

exit $RETVAL


The script that I used to create the SSL certificates from Let's Encrypt. I
did not write it, I put it here to be complete. After installing
certbot-auto, and filling two parameters at the beginning of this script
(and correcting directories as fits to you), this will do what's needed to
create certificates .
LE_renew.sh:
#!/bin/sh
#! /bin/sh
# -----------------------------------------------------------------
# v1.0
# This script will use Lets Encrypt (LE) to request and/or renew
certificates automatically.
# The script will also concatenate the private key and cert chain (Pound's
format) and make it available to Pound Load Balancer
# v1.1
# switch to certbot-auto
# -----------------------------------------------------------------

# Parameters
# -----------------------------------------------------------------
# domains to request certs for, separated by a space
domains=(mywebsite.com www.mywebsite.com)
# email address to user when registering certs
[email protected]
# LE Binary folder (LE binaries)
le_bin=/etc/letsencrypt
# LE Output Folder (default /etc/letsencrypt)
le_output=/etc/letsencrypt
# Port to bind LE standalone server to
le_port=8000
# Pound folder
pound_fol=/etc/pound
# Pound Cert folder
pound_cfol=${pound_fol}/certs
# -----------------------------------------------------------------
# --------------- Do not edit beyond this point -------------------

# Functions
# -----------------------------------------------------------------
# function extracts the number of days the cert in question is still valid
for
# Original work by Acetylator (
https://community.letsencrypt.org/t/how-to-completely-automating-certificate-renewals-on-debian/5615
)
get_days_exp() {
    echo "grep the number of days the cert if valid for"
    local d1=$(date -d "`openssl x509 -in $1 -text -noout|grep "Not
After"|cut -c 25-`" +%s)
    local d2=$(date -d "now" +%s)

    echo "Return result in global variable"
    days_exp=$(echo \( $d1 - $d2 \) / 86400 |bc)
}

# Function to create certificate is pound's required format
create_pound_cert() {
    echo "Create a PEM file in Pound's format / Combine the private key
with fullchain"
    cat ${1} > ${3}
    cat ${2} >> ${3}

    echo "Fix owner and permissions for ${3}"
    chown pound:root ${3}
    chmod 644 ${3}
}
#-----------------------------------------------------------------

# Execution
# -----------------------------------------------------------------
# Create Pound certs folder if it does not exists yet
# Make sure that the cert paths point to the correct folder in the Pound
config file
if [ ! -d ${pound_cfol} ]; then
    echo "creating ${pound_cfol}"
    mkdir ${pound_cfol}

    echo "fix owner and permissions for ${pound_cfol}"
    chown pound:root ${pound_cfol}
fi

echo "For each domain in '$domains' array check certs"
for domain_name in "${domains[@]}"
    do
        # Variables for this for loop (Required as it used the domain_name
from the domains array)
        # ---------------------------
        # LE Live folder
        le_live=${le_output}/live/${domain_name}
        # LE live certs
        le_cert=${le_live}/cert.pem
        # Pound cert folder for every domain
        pound_cert=${pound_cfol}/${domain_name}
        # ---------------------------

        # if a Pound cert file does not exist
        echo "Checking if ${pound_cert} exists"
        if [ ! -e ${pound_cert}  ]; then
            echo "${pound_cert} does not exist"

            # if a LE cert does not exist request it
            echo "Checking if ${le_cert} exists"
            if [ ! -e ${le_cert} ]; then
                echo "${le_cert} does not exist"
                echo "Requesting cert for ${domain_name}"
                ${le_bin}/certbot-auto certonly --standalone --agree-tos
--domains ${domain_name} --email ${email} --standalone-supported-challenges
http-01 --http-01-port 8000 --renew-by-default
# --rsa-key-size 4096
            fi

            echo "Creating pound cert for ${domain_name}"
            create_pound_cert ${le_live}/privkey.pem
${le_live}/fullchain.pem ${pound_cert}

            echo "set parameter used to determine if pound needs to be
restarted"
            restart=1
        fi

        echo "Check the number of days the cert is still valid for"
        get_days_exp "${le_cert}"
        echo "${domain_name}'s cert is valid for another ${days_exp}"

        # If the certificate is valid for 30 or less days
        if [ ${days_exp} -le "30" ]; then
            # The renew command is the same as the initial request command
- it will use the config file in ${le_output}/renewal
            # if you used LE for this domain before (for example using the
test parameter) you may need to alter the renew config file
            echo "Renewing cert for ${domain_name}"
            ${le_bin}/certbot-auto certonly --standalone --agree-tos
--domains ${domain_name} --email ${email} --standalone-supported-challenges
http-01 --http-01-port 8000 --renew-by-default
# --rsa-key-size 4096

            echo "Creating pound cert for ${domain_name}"
            create_pound_cert ${le_live}/privkey.pem
${le_live}/fullchain.pem ${pound_cert}

            echo "set parameter used to determine if pound needs to be
restarted"
            restart=1
        fi
    done

if [ "${restart}" == "1" ]; then
    echo "Restart Pound to load new certs"
    /etc/init.d/pound restart
else
    echo "No new or renewed certs - no restart required"
fi
# -----------------------------------------------------------------


And every sunday at 4, the crontab check them and renew as needed...

00 04 * * 7 [ $(date +%d) -le 07 ] && /etc/letsencrypt/LE_renew.sh
 1>/dev/null 2>&1

















cordialement,

Christian COMMARMOND
+33 6 82 33 52 32

2016-10-28 17:33 GMT+08:00 Alexander Kolodziej <
[email protected]>:

> In your Listener you put one of these for each server
>
> Service
>         URL             "/path.*"
>         Include         "/etc/pound/backend-server1-80.cfg"
> End
>
>
> And the contents of backend-server1-80 can be
>
> BackEnd
>         Address IP
>         Port    80
> End
>
> Or you just inline it all if you only have 3 servers.
>
>   / alex
>
>
> --
> Alexander Kolodziej
> Pattern Matchician, Tactel AB
> Phone: +46761452104
> Email: [email protected]
>
> On 10/28/2016 01:13 AM, Christian COMMARMOND wrote:
>
> Hi,
>
> I was able to compile and use pound. But I would like to use it a way that
> is maybe not possible...
>
> I have only one domain name, but three servers with different functions.
> One has wiki, another has wordpress and the third has a special app based
> on Oracle.
>
> So I have www.mydomain.com/wiki, www.mydomain.com/wordpress and
> www.mydomain.com/oracle
>
> How to do? If it is possible.
>
> And one more challenge, after will be to use SSL...
>
> At this step, nothing woks, but the 'normal' domain redirection, but with
> only one domain... All help is welcome ;-)
>
> regards,
>
> Christian COMMARMOND
> +33 6 82 33 52 32
>
>
>
>