Let's Encrypt when using Reverse Proxy

Support
1

Hi all,

Problem Description

I am trying to configure a domain with Sympl/Apache and then reverse proxy it to a backend service. In this case, Ghost which listens on localhost:2368
I have tried to correctly set up the domain to exclude Proxying the ./well-known folder by including the following line.

 #Add line to NOT proxy ./well-known so Let's Encrypt can validate the domain directy with Apache.
  ProxyPass /.well-known/$ !

Further down I then have:

# Disable indexes by default on the top-level.
  <LocationMatch "^/+$">
    Options -Indexes
  </LocationMatch>

  # Disable any restrictions or rewrites to /.well-known/acme-challenge
  #   This ensures Let's Encrypt can validate domain ownership.
  <Directory /srv/*/public/htdocs/.well-known/acme-challenge/ >
    Require all granted
    <IfModule rewrite_module>
      RewriteEngine off
    </IfModule>
  </Directory>

  <IfModule rewrite_module>
    # Block access to files and directories starting with '.', other than ./well-known/
    RewriteEngine on
    RewriteCond %{REQUEST_URI} .*/\..*
    RewriteCond %{REQUEST_URI} !/\.well\-known/.*
    RewriteRule ^(.*)$ - [R=403]
  </IfModule>

  #Added to forward to the GHOST install - proxy
  ProxyPreserveHost On
  #Servers to proxy the connection, or
  #List the application servers Usage
  ProxyPass / http://localhost:2368/
  ProxyPassReverse / http://localhost:2368/

Unfortunately it doesnā€™t seem to be paying any attention to this and Iā€™m struggling to get Sympl to get a certificate and thus enable an SSL/TLS config.

I have tried with a suggestion to try adding a file within ./well-known and have added test.txt. I canā€™t browse to www.domain.uk/.well-known/test.txt - I get a file not found.

This site is served on an IPV6 only server so I also have the added issue of getting the DNS and IPv4 proxy working through Mythic-Beasts. I think this is working correctly as I have also set up www.domain.com but without any apache reverse proxying (just normal vhost) and I can access a simliarly placed www.domain.com/.well-known/test.txt. Domain.com has also managed to be configured with a certificate too.

So Iā€™m fairly convinced itā€™s my own config causing the problem or Iā€™m not getting Apache to actually serve the ./well-known folder locally.
Iā€™d appreciate any suggestions on what Iā€™m not doing right here, thanks

Cheers
Martin

Environment

  • Sympl Version: 13.20250828.0
  • Sympl Testing Version:
  • Debian Version: 6.12.101+deb13-cloud-amd64
  • Hardware Type: Virtual Server
  • Hosted With: Mythic-Beasts
2

I never managed to do this. Instead I wrote a bash script to remove the reverse proxy, reload apache, renew the certificate, put the proxy back, reload apache.
Only takes a very short time, so its a suitable workaround, but if there was a way to sidestep the .wellknown proxy, I would.

1 Like
3

Hi,

Thanks for the reply. Yeah that sounds like a reasonable work around, at least someone else has experienced a similar problem and Iā€™m not completely bashing my head against the wall. Everything Iā€™d searched for so far indicated not reverse proxying a folder ā€œshouldā€ have worked.

Cheers

4

cd /srv/redacted.uk/config
echo ā€˜moving apache.dā€™
mv apache.d apache.d0
echo ā€˜restarting apacheā€™
sudo systemctl restart apache2
echo ā€˜renewing sslā€™
sudo sympl-ssl redacted.uk --verbose --force
echo ā€˜putting apache.d backā€™
mv apache.d0 apache.d
echo ā€˜restarting apacheā€™
sudo systemctl restart apache2
echo ā€˜doneā€™

5

Thanks for this. I had another go at doing this again but from /site to the ghost instance. However this seemed to make things worse. My idea had been that I could then use a basic http re-direct the default.htm page to www.domain.uk/site/ā€¦
In the longer term I may re-visit this as this seems like another solution, but for now it is working.
Thanks for the help