Join Log in
Score:0
Toorero avatar Server

Apache Reverse Proxy for SSH Tunnel

pt flag
Toorero

I want to set up an Apache reverse proxy for my Home-Assistant(hass) instance running in my local network.

I tunnelled the traffic of the local hass instance to a remote server with ssh -N [email protected] -R 8123:localhost:8123.

Now I tried to set up a plain reverse proxy in Apache:

<VirtualHost *:443>
    ServerName hass.example.com

    SSLEngine On

    # If you manage SSL certificates by yourself, these paths will differ.
    SSLCertificateFile fullchain.pem
    SSLCertificateKeyFile privkey.pem

    SSLProxyEngine on
    SSLProxyProtocol +TLSv1.2 +TLSv1.3
    SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyVia On
    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
    
            
    # Proxy all traffic to hass
    ProxyPass / http://localhost:8123/ nocanon
    ProxyPassReverse / http://localhost/
    ErrorLog ${APACHE_LOG_DIR}/hass.example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/hass.example.com-access.log combined
    <IfModule security2_module>
        SecRuleEngine off
    </IfModule>
</VirtualHost>

<VirtualHost *:80>
    ServerName hass.example.com

    Redirect permanent / "https://hass.example.com"

    ErrorLog ${APACHE_LOG_DIR}/hass.example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/hass.example.com-access.log combined
</VirtualHost>

Sadly if I try to open hass.example.com, the browser responds with 400: Bad Request.

321
0 + 0
ssh
djdomi avatar
za flag
djdomi
you want guacamole, apache cant handle ssh by itself
0
Reply
us flag
Tero Kilkanen
Is your `hass` configured to run at domain name `hass.example.com`?
0
Reply
Toorero avatar
pt flag
Toorero
@Tero Kilkanen No. It's just an vanilla docker container listening on localhost.
0
Reply
Toorero avatar
pt flag
Toorero
@djdomi I don't use SSH with Apache. I just use the (via SSH) local port `8123` and just want to proxy it.
0
Reply
us flag
Tero Kilkanen
The `hass` should have configuration for its root domain name. You need to check that.
0
Reply
Toorero avatar
pt flag
Toorero
I actually don't get why this should be a problem because it's a transperent proxy. The proxy only requests `localhost:8123`. I should add: If I do something along the lines of `ssh -L 8123:localhost:8123 -N [email protected]` I can easily access `localhost:8123` on the machine I executed the command. So the SSH tunnel itself is working.
0
Reply
Toorero avatar
pt flag
Toorero
@TeroKilkanen I also tried to open the port 8123 to the public and I'm able to access my hass instance via example.com:8123 but that's not really what I want, since I want to route my traffic through the Apache proxy. I don't think the root domain name is in any way configurable and doesn't matter.
0
Reply
Score:0
Toorero avatar Server
pt flag
Toorero

It all boils down to Home-Assistant blocking revers-proxy attempts and that you have to proxy websocket requests as well.

Adjusted hass-config (config/configuration.yaml):

http:
  use_x_forwarded_for: true
  trusted_proxies:
  - ::1
  - 127.0.0.1
  ip_ban_enabled: true
  login_attempts_threshold: 5

Apache config:

<VirtualHost *:443>
    ServerName hass.example.com

    SSLEngine On

    # If you manage SSL certificates by yourself, these paths will differ.
    SSLCertificateFile fullchain.pem
    SSLCertificateKeyFile privkey.pem

    SSLProxyEngine on
    SSLProxyProtocol +TLSv1.2 +TLSv1.3
    SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyVia On
    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
    
            
    # Proxy all traffic to hass
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket
    RewriteRule /(.*) ws://localhost:8123/$1 [P]
    RewriteCond %{HTTP:Upgrade} !=websocket
    RewriteRule /(.*) http://localhost:8123/$1 [P]
    ProxyPassReverse / http://localhost:8123


    ErrorLog ${APACHE_LOG_DIR}/hass.example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/hass.example.com-access.log combined
    <IfModule security2_module>
        SecRuleEngine off
    </IfModule>
</VirtualHost>

<VirtualHost *:80>
    ServerName hass.example.com

    Redirect permanent / "https://hass.example.com"

    ErrorLog ${APACHE_LOG_DIR}/hass.example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/hass.example.com-access.log combined
</VirtualHost>
0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.