I am trying to deploy our new Wordpress (with Apache2 in Docker) one-pager over our existing setup.
Right below the LB we have an Nginx server that terminates SSL and proxies plain HTTP requests to Apache2 backends via Haproxy.
Everything is working fine with that setup.
However now we're routing all subdomains along with the /login page to the old application via Haproxy the same way as before, and sending everything else to our Wordpress server (also via a reverse proxy to its own Apache2). The goal is to have only the home page and WP resources served by our Wordpress container, and serve the old application from all subdomains + its /login page.
Subdomain routing works fine and we are reaching the application. The problem is with Wordpress pages which partially load content via HTTP (thus showing mixed content), and for which we cannot access it's /wp-admin page (which enters an infinite loop).
Here's the config:
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
server {
listen 80;
listen [::]:80;
server_name website.info www.website.info;
location / {
return 301 https://$server_name$request_uri;
}
}
server {
listen 443 ssl spdy;
listen [::]:443 ssl;
server_name website.info www.website.info;
root /var/www/htdocs/;
ssl_certificate /usr/local/ssl.crt;
ssl_certificate_key /usr/local/website.com.key;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m;
ssl_dhparam /usr/local/dhparam.pem;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
ssl_buffer_size 8k;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /usr/local/ssl.crt;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
location / {
index index.php
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_send_timeout 90s;
proxy_read_timeout 90s;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_connect_timeout 75s;
proxy_redirect off;
proxy_pass http://172.16.11.11/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $remote_addr;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_pass_header Server;
}
location /login {
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_send_timeout 90s;
proxy_read_timeout 90s;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_connect_timeout 75s;
proxy_redirect off;
proxy_pass http://127.0.0.1:3214/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $remote_addr;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_pass_header Server;
}
location /wp-admin/ {
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_send_timeout 90s;
proxy_read_timeout 90s;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_connect_timeout 75s;
proxy_redirect off;
proxy_pass http://172.16.11.11/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $remote_addr;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_pass_header Server;
}
}
server {
listen 443 default ssl spdy;
listen [::]:443 ssl;
server_name *.website.info;
root /var/www/htdocs;
ssl_certificate /usr/local/chain1.pem;
ssl_certificate_key /usr/local/key1.pem;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m;
ssl_dhparam /usr/local/dhparam.pem;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
ssl_buffer_size 8k;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /usr/local/sslcert/ssl-unified.crt;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
location /public/ {
expires max;
add_header Pragma public;
add_header Cache-Control "public";
}
location / {
index index.php
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_send_timeout 90s;
proxy_read_timeout 90s;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_connect_timeout 75s;
proxy_redirect off;
proxy_pass http://127.0.0.1:3214/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $remote_addr;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_pass_header Server;
}
location ~ /\.ht {
deny all;
}
}
At this point I think I'm missing something trivial and would appreciate another set of eyes on the issue.
