cedricAbonnel/varlog
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

init : articles varlog (migration depuis rsync)

Browse Source
This commit is contained in:
Cédrix
2026-05-15 10:37:48 +02:00
commit b0716911b3
5573 changed files with 107423 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
_cache/articles/17e688f6-2ef2-428b-b746-51aa3d3ae053.json
+1
View File
@@ -0,0 +1 @@
{"uuid":"17e688f6-2ef2-428b-b746-51aa3d3ae053","slug":"https-proxy-apache2","title":"Apache 2 : proxy-reverse : configurer un site en https pour un sous-domaine","author":"cedric@abonnel.fr","published":true,"published_at":"2023-02-09 16:12:18","created_at":"2023-02-09 16:12:18","updated_at":"2023-02-09 16:12:18","revisions":[],"cover":"","files_meta":[],"external_links":[],"seo_title":"","seo_description":"","og_image":"","category":"Informatique","content":"# Apache 2 : proxy-reverse : configurer un site en https pour un sous-domaine\n\nVoici mes prises de notes pour configurer un site Internet **http**. Le configuration est destinée pour un site Internet commençant par **www**.\n\n```\nConfigurer Apache 2\n http:*www.abonnel.fr ==> https:*www.abonnel.fr <==[reverse-proxy]==> 54.1.23.4\n```\n\n## Pré requis\nJe viens de demander un certificat SSL pour le site Internet. Il faut configurer Apache 2 pour que :\n- les demandes en https utilisent le certificat SSL\n- toutes les visites en http soit redirigé en https\n\n# Configurer\nJe complète le fichier de configuration `/etc/apache2/sites-available/100-com.perdu.extra.conf`. J'ajoute un bloc de redirection vers `https` :\n\n```\nRewriteEngine On\nRewriteCond %{SERVER_NAME} =extra.perdu.com\nRewriteCond %{REQUEST_URI} !\\.well-known/acme-challenge/.*\nRewriteRule ^ https:*%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]\n```\n\nPuis, j'ajoute un bloc pour la configuration SSL / https. Il s'agit d'un copier/coller de la configuration http.\nJ'effectue quelques modifications :\n- et pour l’écriture des fichiers logs\n- pour la redirection des URL sans www\n- Ajout des options SSL\n- Ajout de la gestion des certificats\n\n```\n<IfModule mod_ssl.c>\n<VirtualHost *:443>\n\n ServerName extra.perdu.com\n\n ProxyPreserveHost On\n ProxyPass \"/\" \"http:*103.224.182.253/\"\n ProxyPassReverse \"/\" \"http:*103.224.182.253/\"\n \n Include /etc/letsencrypt/options-ssl-apache.conf\n SSLCertificateFile /etc/letsencrypt/live/extra.perdu.com/fullchain.pem\n SSLCertificateKeyFile /etc/letsencrypt/live/extra.perdu.com/privkey.pem\n\n</VirtualHost>\n</IfModule>\n```\n\nLes options SSL sont à créer une seule fois sur le serveur. Ces options sont communes à tous les sites Internet que je configure.\nLes options dans `/etc/letsencrypt/options-ssl-apache.conf` sont les suivantes :\n```\nSSLEngine on\n\n# intermediate configuration, tweak to your needs\nSSLProtocol -ALL +TLSv1.2\nSSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:!RC4:HIGH:!MD5:!aNULL:!EDH\n\nSSLHonorCipherOrder on\n\nSSLCompression on\n#SSLSessionTickets off\n\n# -- Securité supplémentaire\n\nSSLOptions +StrictRequire\n\n# HSTS (mod_headers is required) (15768000 seconds = 6 months)\nHeader always set Strict-Transport-Security \"max-age=15768000\"\n\n# Always ensure Cookies have \"Secure\" set (JAH 2012/1)\nHeader edit Set-Cookie (?i)^(.*)(;\\s*secure)??[^note: \\s*;)?(.*] \"$1; Secure$3$4\"\n```\n\n---\nCe qui donne une configuration globale suivante :\n\n```\n<VirtualHost *:80>\n\n ServerName extra.perdu.com\n\n # ProxyPass devient obsolète avec RewriteRule\n ProxyPass /.well-known/acme-challenge !\n Alias /.well-known/acme-challenge /var/www/html/.well-known/acme-challenge\n\n <Directory \"/var/www/html/.well-known/acme-challenge\">\n Options None\n AllowOverride None\n Require all granted\n AddDefaultCharset off\n </Directory>\n\n # Proxy* deviennent obsolète avec Rewrite*\n ProxyPreserveHost On\n ProxyPass \"/\" \"http:*103.224.182.253/\"\n ProxyPassReverse \"/\" \"http:*103.224.182.253/\"\n\n RewriteEngine On\n RewriteCond %{SERVER_NAME} =info.mindcast.fr\n RewriteCond %{REQUEST_URI} !\\.well-known/acme-challenge/.*\n RewriteRule ^ https:*%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]\n\n</VirtualHost>\n\n<IfModule mod_ssl.c>\n<VirtualHost *:443>\n\n ServerName extra.perdu.com\n\n ProxyPreserveHost On\n ProxyPass \"/\" \"http:*103.224.182.253/\"\n ProxyPassReverse \"/\" \"http:*103.224.182.253/\"\n \n Include /etc/letsencrypt/options-ssl-apache.conf\n SSLCertificateFile /etc/letsencrypt/live/extra.perdu.com/fullchain.pem\n SSLCertificateKeyFile /etc/letsencrypt/live/extra.perdu.com/privkey.pem\n\n</VirtualHost>\n</IfModule>\n```\n\n# Recharger\nAprès ces modifications, je recharge la configuration de Apache 2 :\n```\nsudo service apache2 reload\n```\n\n# Liens\nhttps://stackoverflow.com/questions/20406845/proxy-error-502-the-proxy-server-received-an-invalid-response-from-an-upstream","featured":false,"tags":[]}