0

Yesterday I did my first steps with docker on my VPS and installed Redmine. After setting it up I decided that I want it to be accessible via subdomain instead of port.

In my Apache host settings I'm using ProxyPass for this and it works:

ProxyPass / http://127.0.0.1:22679/
ProxyPassReverse / http://127.0.0.1:22679/

This is my vhost config:

<VirtualHost *:443>
    ProxyPass / http://127.0.0.1:22679/
    ProxyPassReverse / http://127.0.0.1:22679/
    ServerName redmine.example.com
</VirtualHost>

This works via https (https://redmine.example.org), but I'm a bit concerned about security and the right usage of ProxyPass. I would block the ports via iptables so it can't be accessed from outside only from my localhost.

So what I want to ask is: Is this completely fine or am I doing it wrong? Also it seems a bit "weird" to me that I'm getting through my https:// domain http:// traffic from localhost. I searched the internet how to make a docker app accessible via a subdomain, but the only thing I found was this solution with ProxyPass.

  • How apache listener and virtualhost are configured? Do you have a SSL certificate? – Mircea Vutcovici Oct 21 '16 at 5:51
  • Yes I have a LE certificate for that domain, but what do you mean with apache listener? – Stefan Schmid Oct 21 '16 at 7:10
  • Could you list the apache config? – Mircea Vutcovici Oct 21 '16 at 7:20
  • I added the vhost, but left out all the SSL stuff as this works as expected. I access https://redmine.example.com and it gets the stuff from http://127.0.0.1:22679 – Stefan Schmid Oct 21 '16 at 9:18
0

Doing a ProxyPass to a application running on a local port is a very common approach. Your configuration includes everything that is needed there and is perfectly fine.

As only have one process can bind to port 443 (HTTPS) at a time, you have to use a Webserver like Apache as a Reverse Proxy.

Regarding Security, configuring iptables to only allow connections from localhost to that port, is best practice if you cannot directly configure your application to only listen on localhost in the first place.

Using plain http for the communication between your Reverse Proxy (Apache) and your backend (Redmine) is no problem here, as the communication between them never leaves the host. This way, you can also configure your TLS Certificates in a single place (Apache) and don't have to worry about whether your application itself even supports TLS in a secure configuration.

For a secure Apache TLS Config you can use e.g. https://mozilla.github.io/server-side-tls/ssl-config-generator/.

  • Thanks for your answer. Sounds nice, that I didn't it kinda correctly. I'm completely new to docker so I thought that there might be another way to use those applications with Apache. – Stefan Schmid Oct 21 '16 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.