1

I intend to create the following setup with a single server droplet:

enter image description here

  • What I want to achieve is to only setup SSL / HTTPS once for my Apache2 web server using a wildcard certificate as depicted above.
  • Furthermore I want to configure multiple subdomains for Apache2 that direct traffic to individual Ports via ProxyPass, each port mapping to a different Docker container, this time using HTTP instead of HTTPS (as shown above).
  • Additionally, I have setup "Redirect permanents" for Apache2 making sure that e.g. http://x.domain.com is always redirected to https://x.domain.com

The main advantage I see in this configuration is that I don't have to worry about any kind of SSL configuration inside the Docker containers / for the apps running inside the Docker containers. Furthermore, it would be extremely easy to configure further subdomains and have additional containers running, all supporting SSL / HTTPS out of the box.

Now my question(s):

  • Is the above setup reasonable, is there something I could improve?
  • Are there any kind of security issues?
  • At the moment it is still possible to directly enter e.g. "http://x.domain.com:6000" in the browser and SSL / HTTPS is bypassed. Is there any issue with that from a security POV and if yes, how could I prevent that?

1 Answer 1

3

Yes, this seems like a good configuration. I don't see any obvious problems, except the one in your question 3.

The only problem with letting the http://*.domain.com:6xxx connection through is that it's HTTP, not HTTPS. To prevent that you can redirect those connections too:

RewriteCond %{HTTP_HOST} ^(.*)\.domain\.com$
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%1.domain.com$1
2
  • Thank you for your answer. Am I correct to assume tho that this is not something that affects the security of my own (other) applications connecting to those docker containers, as long as I'm connecting via HTTPS (SSL)? Oct 31, 2020 at 19:47
  • Additionally, I already have a redirect for http to https in place but it does not work as soon as I append the port to the url, is that something the RewriteConds you mentioned are fixing? Oct 31, 2020 at 19:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .