Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Jira and a Confluence system at my work. Both are running on the same servers. The actual URL to access Jira and Confluence are:

http://foauslxapp05:8080/jira
http;//foauslxapp05:8090/confluence

or with the fully qualified host name:

http://foauslxapp05.foservices.corp:8080/jira
http://foauslxapp05.foservices.corp:8090/confluence

To simplify everything, I've setup a proxy rule to allow users to do this:

http://foauslxapp05/jira  <-- Accessing Jira
http://foauslxapp06/wiki  <-- Accessing Confluence

Our techs have created pair of server aliases for foauslxapp05, so that:

http://jira/jira     <-- Accessing Jira
http://jira.foservices.corp/jira  <-- Accessing Jira
http://wiki/wiki     <-- Accessing Confluence
http://wiki.foservices.corp/wiki  <-- Accessing Confluence

What I'd really like to do is take this to the next step:

http://jira    <-- Accessing Jira
http://jira.foservices.corp  <-- Accessing Jira
http://wiki    <-- Accessing Confluence
http://wiki.foservices.copr  <-- Accessing Confluence

The problem, of course, is that the DNS names jira and wiki are merely DNS aliases for foauslxapp05. I need to detect the URL that the user entered (i.e. what host the user requested), then based upon that URL, I need to redirect the user to the correct application.

I'm not even too sure what I should be looking at: Is this VirtualHost? mod_rewrite? mod_proxy? Or, is this something else entirely. I can't imagine something like this being too difficult to do. Unfortunately, I'm just not too familiar with Apache httpd.

share|improve this question
    
Can you clarify how your proxy configuration is set up now? Maybe provide that <VirtualHost> block? – Shane Madden Apr 24 '12 at 16:13

You can do this by using the ServerAlias variable in your virtual host configuration, this configuration item can support a list of server names/aliases:

http://httpd.apache.org/docs/2.0/vhosts/name-based.html

share|improve this answer

What you want is name-based virtual hosts. Because you're likely to get lots of bad advice on how to structure this, I suggest the following as being a nice and clear (perhaps slightly duplicated) way of doing this.

But before I begin, I would say: where does Crowd fit into this picture (Crowd being the SSO piece that joins Jira and Confluence together fairly nicely). In our deployment, we have jira.example.com/jira, jira.example.com/confluence, and the same for /crowd, and /servicedesk, and whatever next comes along. You may want to consider how you solution will grow (I'm not saying that your solution is bad, or even worse than ours, but it is something to bear in mind).

Okay, to the configuration. You need to tell Apache that you're using name-based virtual hosting on HTTP and HTTPS.

# Look in /etc/httpd/conf/httpd.conf
NameVirtualHost *:443
NameVirtualHost *:80

Presumably you have mod_ssl installed, and mod_proxy_ajp to reverse-proxy back to the tomcat servlets providing you with Jira / Confluence etc.

Hopefully you're familiar with setting up mod_ssl, so you've got your certificates etc. I haven't experience with SNI (and if you're still using RHEL5, that's not really an option, but you didn't say which version of RHEL you are using), so I'll assume you have a SAN certificate with names like:

  • jira.example.com (or rather jira.foservices.corp, but I'm going to use example.com going forward)
  • confluence.example.com
  • crowd.example.com (you didn't say if you're using that...)

If you're using RHEL5 or RHEL6, you'll want to service httpd stop; edit /etc/sysconfig/httpd and enable the worker MPM (uncomment the HTTPD line), which will give you better scalability; then service httpd start. RHEL7 uses httpd 2.4 by default and has the newer event MPM, I believe, which would be better than either of the previous.

Edit /etc/httpd/conf/httpd.conf and comment out any modules (LoadModule ...) that are not needed. If you don't know, do a few at a time and use apachectl configtest to you test your config, as the default config will require a number of them.

While you're there, I would recommend enabling KeepAlives; a very good performance boost.

I'm doing to put all of those virtual hosts in /etc/httpd/conf.d/sites.conf. I hope you'll appreciate that there is some apparent duplication, but by separating each name/service into a different VirtualHost stanza adds a great amount of clarity.

I'll start with the basic structure showing all the sites (jira and confluence), and then flesh out the virtual host for jira (the other will be fairly similar).

<VirtualHost *:80>
    ServerName jira.example.com
</VirtualHost>

<VirtualHost *:443>
    ServerName jira.example.com
</VirtualHost>

<VirtualHost *:80>
    ServerName confluence.example.com
</VirtualHost>

<VirtualHost *:443>
    ServerName confluence.example.com
</VirtualHost>

Okay, so that's pretty high-level; let's have a closer look at the jira virtual-hosts. First, I define a virtual host for HTTP access that just redirects to HTTPS.

<VirtualHost *:80>
    ServerName jira.example.com

    ErrorLog ...
    CustomLog ...

    Redirect 301 / https://jira.example.com/
</VirtualHost>

The HTTPS site is where all the action is:

<VirtualHost *:443>
    ServerName jira.example.com

    SSLEngine On
    SSLProtocol all -SSLv2 -SSLv3

    # The following could be tigher...
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

    # If using a SAN certificate, the following would be the same for crowd
    SSLCertificateFile /etc/pki/tls/certs/jira_etc.pem
    SSLCertificateKeyFile /etc/pki/tls/private/jira_etc.key
    SSLCertificateChainFile /etc/pki/tls/certs/jira_etc.pems

    ErrorLog ... # don't forget log rotation
    CustomLog ...

    # Enough boilerplate, down to Jira specifics. Check which ports are
    # used for each or jira/confluence etc. The command (as root or as 
    # the account running the apps) may be helpful. You want the AJP port;
    # not the HTTP port.
    #
    #    'lsof -Pni | grep LISTEN | grep java'

    # Speed boost
    AddOutputFilterByType DEFLATE text/html text/plain text/xml

    ProxyPass          / ajp://127.0.0.1:8009/jira
    ProxyPassReverse   / ajp://127.0.0.1:8009/jira
</VirtualHost>

TIP: One thing to think about: what do you want to happen if people go to, say http://foauslxapp05.foservices.corp/ (the default site), or to the server's IP address directly? I suggest you respond with either a 404 (not found) or a 403 (forbidden). Here's a fragment for you to integrate as homework. Use httpd -S to get a very useful summary of which sites are defined in your current configuration (not running-config, but config files as they currently are), and note that order matters (another reason why I put it all in conf.d/sites.conf, rather than conf.d/jira.conf and conf.d/confluence.conf etc.

<VirtualHost _default_:80>
    RewriteEngine On
    RewriteRule ^ - [R=404,L]
</VirtualHost>

I suggest you do a similar thing for the default https site in conf.d/ssl.conf

If hope you've found this post useful and informative.

Cheers, Cameron

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.