Passioni › Informatica › Linux

Reverse Proxy Apache per applicazioni interne

Come esporre servizi interni (Node.js, Flask, Grafana, etc.) su HTTPS tramite Apache come reverse proxy.

1. Abilitare i moduli necessari

a2enmod proxy proxy_http proxy_wstunnel ssl headers rewrite
systemctl restart apache2

2. VirtualHost con reverse proxy

Esempio per un'app Flask su porta 5000:

nano /etc/apache2/sites-available/app.miosito.it.conf

<VirtualHost *:443>
    ServerName app.miosito.it

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/app.miosito.it/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/app.miosito.it/privkey.pem

    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:5000/
    ProxyPassReverse / http://127.0.0.1:5000/

    # WebSocket support
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteRule /(.*) ws://127.0.0.1:5000/$1 [P,L]

    # Security headers
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"

    ErrorLog ${APACHE_LOG_DIR}/app-error.log
    CustomLog ${APACHE_LOG_DIR}/app-access.log combined
</VirtualHost>

<VirtualHost *:80>
    ServerName app.miosito.it
    Redirect permanent / https://app.miosito.it/
</VirtualHost>

3. Attivazione

a2ensite app.miosito.it.conf
apache2ctl configtest
systemctl reload apache2

4. Proxy verso rete interna

Per proxare verso un server LAN (es. 192.168.1.100:3000):

ProxyPass / http://192.168.1.100:3000/
ProxyPassReverse / http://192.168.1.100:3000/

Risultato: Servizi interni accessibili via HTTPS con certificato SSL, WebSocket e security headers.