How to Configure Apache as a Reverse Proxy with mod_proxy?

Apache is a versatile web server application capable of serving dynamic web content or functioning as a reverse proxy. As a reverse proxy, it forwards client requests to back-end servers. This guide shows how to configure Apache as a reverse proxy using the mod_proxy module.

In this guide, you will learn about proxying an ownCloud application running on port 8080 within a Docker container. However, the same approach can be applied to proxy other applications running on different ports.

Requirements

• Deploy a fresh Vultr Cloud Server.

Note: This article uses an Ubuntu 20.04 server, but the instructions are applicable to any Linux server running Apache.

• Set up a DNS “A” record pointing to the server’s IP address. This guide uses the name app.example.com.
• Connect to the server.
• Log in as a non-root user with sudo privileges.
• Update the server.
• Install Apache.
• Install Docker.

1. Enable mod_proxy

• Enable mod_proxy in Apache
• To configure Apache as a reverse proxy, start by enabling the required modules.
• Enable the core mod_proxy module:

sudo a2enmod proxy

Enable additional proxy-related modules:

sudo a2enmod proxy_http
sudo a2enmod proxy_balancer
sudo a2enmod proxy_wstunnel

Here’s what each module does:

• mod_proxy: Provides the core functionality for proxying.
• proxy_http: Handles HTTP and HTTPS proxy requests.
• proxy_balancer: Adds load-balancing capabilities.
• proxy_wstunnel: Facilitates WebSocket tunneling to a back-end server.

• Restart Apache to apply the changes:

sudo systemctl restart apache2

2. Set up the Back-end Application

• You can setup ownCloud container listening on port 8080 under Docker as an example. 
• Execute the following command to create ownCloud docker container. 

$ docker run -d --name owncloud -p 8080:8080 owncloud/server

• Start ownCloud.

$ docker start owncloud

• Then, verify that ownCloud is running.

$ docker ps

3. Setup Apache as a Reverse Proxy

• Before making changes, back up the default Apache virtual host configuration file.

$ sudo mv /etc/apache2/sites-available/000-default.conf  /etc/apache2/sites-available/origdefault.backup

• Create a new configuration file.

$ sudo nano /etc/apache2/sites-available/app.example.com.conf

• Then, update the file with the following content, replacing app.example.com with your server’s domain name. If you are configuring a proxy for an application other than the ownCloud example, update port 8080 to match your application’s port number in the configuration below.

  <VirtualHost *:80>
     ServerName app.example.com
     ProxyPreserveHost On
     ProxyPass / http://127.0.0.1:8080/
     ProxyPassReverse / http://127.0.0.1:8080/
  </VirtualHost>

• Save and close the file.

This is what every directive conveys in the module

• ProxyPreserveHost: Forward the original host header to the back-end application.
• ProxyPass: Directs all requests from/to the specified port of the back-end application.
• ProxyPassReverse: Complements ProxyPass by adjusting response headers sent by the back-end application.

• Activate the configuration file.

$ sudo ln -s /etc/apache2/sites-available/app.example.com.conf  /etc/apache2/sites-enabled/app.example.com.conf

• Test the Apache configuration for errors.

$ sudo apachectl configtest

• Restart Apache to load changes.

$ sudo service apache2 restart

4. Secure The Server

• Make the firewall configuration to allow HTTP traffic on the port 80.

$ sudo ufw allow 80/tcp

• To allow HTTPS traffic on port 443, run the following command.

sudo ufw allow 443/tcp

• Then, restart the firewall to apply the changes.

sudo ufw reload

5. Setup SSL Certificate

• Install Certbot.

$ sudo apt install certbot python3-certbot-apache

• Request a Let’s Encrypt SSL Certificate.

$ sudo certbot -d app.example.com

• Test Auto-renewal.

$ sudo certbot renew --dry-run

6. Testing Is Necessary

• Open a web browser and navigate to your subdomain:

https://app.example.com

• You should see the ownCloud login page. Use the credentials admin for both the username and password to log in and start using the application.