1

I need to setup Apache proxies for multiple servers, one proxy for one server. I can do this in two ways:

  1. Setup one virtual host and multiple proxies. Each server is served as a sub-directory of the virtual host: aaa.bbb.ccc/test1 and aaa.bbb.ccc/test2

    <VirtualHost *:443>
        ServerName aaa.bbb.ccc
        RewriteEngine on
        RewriteRule ^/test1$ /test1/ [R]
        RewriteRule ^/test1(.*) http://localhost:8080$1 [P]          
        RewriteRule ^/test2$ /test2/ [R]
        RewriteRule ^/test2(.*) http://localhost:8081$1 [P]
        <Location "/test1">
            ...
        </Location>
        <Location "/test2">
            ...
        </Location>
        ....
    </VirtualHost>
    
  2. Setup N virtual hosts and N proxies, serving N servers. Each server will be served with one virtual host.

    NameVirtualHost *:443
    <VirtualHost *.443>
        ServerName aaa.bbb.ccc
        RewriteEngine on
        RewriteRule ^(.*) http://localhost:8080$1 [P]
        <Location "/">
            ...
        </Location>
    </VirtualHost>
    <VirtualHost *.443>
        ServerName ddd.bbb.ccc
        RewriteEngine on
        RewriteRule ^(.*) http://localhost:8081$1 [P]
        <Location "/">
            ...
        </Location>
    </VirtualHost>
    

Both works. However I don't know which one is better. Can someone compare the pros and cons of the two approaches?

3
  • Or HAProxy, or nginx or varnish.
    – hookenz
    Sep 5 '14 at 4:15
  • Apache mod_proxy Sep 5 '14 at 4:24
  • Actually, I used apache mod_rewrite for proxying [P] Sep 5 '14 at 4:33
1

There is generally really nothing wrong with either way. But the real big difference between the two is going to be certificate management. Option 1 only requires 1 certificate for SSL. Option 2 depends on what you are doing for hosts names. If the only thing that is changing is the sub-domain, you can use a wild card certificate or you will need a certificate for each virtual host. Both can become expensive.

Generally what will be the biggest real driver between the two options are going to be "business" type decisions. Making a cleaner separation between the internal servers.

How you are actually exposing the internal servers to the outside, is not the most effective way. Technically it is working, but you can come into a lot of issues. Links on the pages can render wrong. On the external website, you would actually be exposing internal links and give the appearance the site is broken. Images and Javascript will also not function correctly or do some funky stuff. You should really be using Proxy and ReverseProxy

ProxyRequests off
ProxyPass /test1/ http://127.0.0.1:8080/
ProxyPass /test2/ http://127.0.0.1:8081/
ProxyHTMLURLMap http://127.0.0.1:8080 /app1
ProxyHTMLURLMap http://127.0.0.1:8081 /app2

<Location /test1/>
        ProxyPassReverse /
        ProxyHTMLEnable On
        ProxyHTMLURLMap  /      /test1/
</Location>

<Location /test2/>
        ProxyPassReverse /
        ProxyHTMLEnable On
        ProxyHTMLURLMap /       /test2/
</Location>
5
  • ProxyPass doesn't work. I got "DNS lookup failure for: localhost:8080" Sep 5 '14 at 20:25
  • use 127.0.0.1 instead of localhost.
    – celias
    Sep 5 '14 at 20:38
  • Forgot to put / at end of localhost:8080. It works once I added the slash. Sep 5 '14 at 21:07
  • I deleted ProxyPassReverse, it still works. Am I doing something wrong? Sep 5 '14 at 21:15
  • In the documentation - httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypassreverse - Basically it is rewriting the Location HEADERS between the outside world and internal server. Simple tests may not expose this
    – celias
    Sep 5 '14 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.