Using Apache as a front-end

Written by Chris Pearson

Scenario Examples

  1. A company website is served off Apache, and the IT department collectively blow fuses if asked to change their setup.

  2. On larger dynamic sites, there might be a requirement to serve static content from one server farm, whilst Orion does the magic.

  3. The company security officer has audited and screwed the Apache box down and won't sign off on the JVM+Orion server having transparent Internet visibility.

  4. You know that some of your clients can only access port 80 outside their corporate firewall (this is very common) and you don't want to run Orion as root (and you're not using an OS with ipchains-like functionality)

A combination of all four examples can occur quite frequently.

Solution

Use Apache as a reverse proxy.

Configuration

Make sure the Apache proxy module is loaded, and configure reverse proxying.

httpd.conf:

...
LoadModule etc..
LoadModule proxy_module /path/to/apache/library/libproxy.so
LoadModule etc..
...

<VirtualHost www.bigcorp.com>
    ProxyVia On
    ProxyPass /myapp http://orion.private.bigcorp.com:9876/
    ProxyPassReverse /myapp http://orion.private.bigcorp.com:9876/
    ProxyPreserveHost On
    ...
</VirtualHost>

Modify the ProxyPass lines as appropriate. In this example, Orion is running on a private-network server on port 9876. Presumably here the Apache server is in a standard DMZ. The ProxyPassReverse directive is necessary to handle HTTP 3xx redirects. If the ProxyPreserveHost directive is not included, any rewriting of URLs from within the webapp will use the internal hostname, rather than www.bigcorp.com.

In this case, if I go to http://www.bigcorp.com/myapp/index.jsp it gets requested to Orion as http://orion.private.bigcorp.com:9876/index.jsp - note that the host has changed, so if hosting multiple virtual web-applications on Orion, you'll probably have to listen on multiple ports.

 You also should add a line to your web site configuration file, to make sure URL rewriting works properly. From web-site.xml, if the above example is running on www.bigcorp.com: 

<frontend host="www.bigcorp.com" port="80" />


Specifying frontend host means that for HTTP 1.0 requests, request.getServerName() will give www.bigcorp.com.  For HTTP 1.1 requests, request.getServerName() will still return the value of the Host: HTTP header as normal (which should be the right host name if ProxyPreserveHost is specified in the apache config).
Specifying frontend port means that for all requests, request.getServerPort() will give 80, rather than the port the request was accepted on.

Copyright © 2007 IronFlare AB