To configure an Apache2 reverse proxy on a Linux server for two WordPress Docker instances with Let’s Encrypt SSL certificates:

Step 1: Install Apache2 and Certbot

First, ensure that Apache2 and Certbot are installed on your Linux server. You can install them using the following commands:

##

###

sudo apt update

sudo apt install apache2

sudo apt install certbot python3-certbot-apache

Step 2: Enable Necessary Apache Modules

Enable the required Apache modules for reverse proxy functionality:

##

###

sudo a2enmod proxy

sudo a2enmod proxy_http

sudo a2enmod ssl

sudo a2enmod headers

sudo a2enmod rewrite

Step 3: Configure Virtual Hosts

Create and configure the virtual host files for each domain.

Configuration for example2.tld

Create a virtual host file for example2.tld:

##

###

sudo nano /etc/apache2/sites-available/example2.tld.conf

Add the following configuration:

apache

###

<VirtualHost *:80>

    ServerName example2.tld

    ProxyPreserveHost On

    ProxyPass / http://10.10.1.100:8080/

    ProxyPassReverse / http://10.10.1.100:8080/

    RewriteEngine on

    RewriteCond %{SERVER_NAME} =example2.tld

    RewriteRule ^ %{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

Configuration for example1.tld

Create a virtual host file for example1.tld:

##

###

sudo nano /etc/apache2/sites-available/example1.tld.conf

Add the following configuration:

apache

###

<VirtualHost *:80>

    ServerName example1.tld

    ProxyPreserveHost On

    ProxyPass / http://10.10.1.100:8081/

    ProxyPassReverse / http://10.10.1.100:8081/

    RewriteEngine on

    RewriteCond %{SERVER_NAME} =example1.tld

    RewriteRule ^ %{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

Step 4: Enable the Virtual Host Files

Enable the new virtual host files:

##

###

sudo a2ensite example2.tld.conf

sudo a2ensite example1.tld.conf

Step 5: Obtain SSL Certificates with Certbot

Use Certbot to obtain SSL certificates for your domains:

##

###

sudo certbot –apache

Follow the prompts to complete the SSL certificate installation. Certbot will automatically update your virtual host files to include the SSL configuration.

Step 6: Verify SSL Configuration

After Certbot completes, your virtual host files should look similar to the following. Verify that the SSL configuration has been added:

example2.tld SSL Configuration

apache

###

<VirtualHost *:80>

    ServerName example2.tld

    RewriteEngine on

    RewriteCond %{SERVER_NAME} =example2.tld

    RewriteRule ^ %{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

<VirtualHost *:443>

    ServerName example2.tld

    ProxyPreserveHost On

    ProxyPass / http://10.10.1.100:8080/

    ProxyPassReverse / http://10.10.1.100:8080/

    SSLEngine on

    SSLCertificateFile /etc/letsencrypt/live/example2.tld/fullchain.pem

    SSLCertificateKeyFile /etc/letsencrypt/live/example2.tld/privkey.pem

    Include /etc/letsencrypt/options-ssl-apache.conf

</VirtualHost>

example1.tld SSL Configuration

apache

###

<VirtualHost *:80>

    ServerName example1.tld

    RewriteEngine on

    RewriteCond %{SERVER_NAME} =example1.tld

    RewriteRule ^ %{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

<VirtualHost *:443>

    ServerName example1.tld

    ProxyPreserveHost On

    ProxyPass / http://10.10.1.100:8081/

    ProxyPassReverse / http://10.10.1.100:8081/

    SSLEngine on

    SSLCertificateFile /etc/letsencrypt/live/example1.tld/fullchain.pem

    SSLCertificateKeyFile /etc/letsencrypt/live/example1.tld/privkey.pem

    Include /etc/letsencrypt/options-ssl-apache.conf

</VirtualHost>

Step 7: Restart Apache

Finally, restart Apache to apply the changes:

##

###

sudo systemctl restart apache2

Conclusion

Your Apache2 reverse proxy should now be configured to redirect traffic for example2.tld to http://10.10.1.100:8080 and example1.tld to http://10.10.1.100:8081 with SSL encryption provided by Let’s Encrypt.

Are there any security considrations?

ChatGPT

Yes, there are several security considerations to keep in mind when configuring an Apache2 reverse proxy with SSL:

1. Keep Software Up-to-Date

Ensure that Apache, Docker, and all related software are kept up-to-date with the latest security patches. This minimizes vulnerabilities from known exploits.

2. Secure Docker Containers

Isolate Containers: Run Docker containers with the minimum required privileges. Use user namespaces and avoid running containers as the root user.

Network Security: Use Docker’s network features to isolate containers and limit their communication to only what’s necessary.

3. Harden Apache Configuration

Use Strong SSL/TLS Settings: Ensure that your SSL/TLS configuration is secure by enforcing strong ciphers and protocols. You can refer to resources like Mozilla’s SSL Configuration Generator for recommended settings.

apache

###

<VirtualHost *:443>

    SSLEngine on

    SSLCertificateFile /etc/letsencrypt/live/yourdomain/fullchain.pem

    SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain/privkey.pem

    Include /etc/letsencrypt/options-ssl-apache.conf

    # Additional security settings

    SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

    SSLCipherSuite HIGH:!aNULL:!MD5:!3DES

    SSLHonorCipherOrder on

    SSLCompression off

    # HTTP Strict Transport Security (HSTS)

    Header always set Strict-Transport-Security “max-age=31536000; includeSubDomains”

    # Prevent clickjacking

    Header always append X-Frame-Options DENY

    # Prevent MIME-based attacks

    Header set X-Content-Type-Options nosniff

</VirtualHost>

4. Enable Security Modules

ModSecurity: Consider installing and configuring ModSecurity as a Web Application Firewall (WAF) to protect against common web attacks.

##

###

sudo apt install libapache2-mod-security2

Fail2Ban: Use Fail2Ban to protect against brute force attacks by monitoring and banning IP addresses with suspicious activity.

5. Monitor Logs and Activity

Regularly monitor Apache logs (/var/log/apache2/), Docker logs, and system logs for any unusual activity or potential security incidents.

6. Limit Access to Apache Configuration Files

Ensure that Apache configuration files are only editable by authorized users. Set proper file permissions:

##

###

sudo chown -R root:root /etc/apache2

sudo chmod -R 750 /etc/apache2

7. Use Firewalls

Configure a firewall to limit access to only the necessary ports (e.g., 80 and 443 for HTTP and HTTPS) and to restrict access to the Docker management interface.

8. Backup and Recovery Plan

Implement a regular backup strategy for your server configurations and Docker containers. Ensure you have a tested recovery plan to restore services in case of failure.

9. Regular Security Audits

Conduct regular security audits and vulnerability scans of your server and applications. Tools like OpenVAS, Nessus, or even manual audits can help identify and mitigate security risks.

10. Implement Access Controls

Limit SSH Access: Use key-based authentication for SSH and disable password-based logins. Restrict SSH access to specific IP addresses if possible.

Use .htaccess for Additional Security: Restrict access to certain parts of your web server using .htaccess files.

Conclusion

By following these security considerations, you can significantly enhance the security of your Apache reverse proxy setup. Always stay vigilant and proactive in addressing potential security threats.