Wiki source code of Configure HTTPS for the Apache HTTP Proxy Server
Last modified by Eleni Cojocariu-testing account on 2026/08/18 11:38
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | Once Apache forwards requests to XWiki on port ##80##, a second ##VirtualHost## on port ##443## serves the same wiki over ##HTTPS## and the port ##80## one redirects to it. This procedure continues [[Configure Apache HTTP Server as a Proxy on a Linux OS>>doc:documentation.xs.admin.installation.http-reverse-proxy.apache-key-configurations.configure-apache-server-linux.WebHome]], and the directives it adds are described in [[Apache Server Key Configurations>>doc:documentation.xs.admin.installation.http-reverse-proxy.apache-key-configurations.WebHome]]. | ||
| 2 | |||
| 3 | 1. Obtain a TLS certificate and its private key for the wiki's domain. | ||
| 4 | 1. Enable the modules the configuration below needs: {{code language="none"}}sudo a2enmod ssl headers rewrite{{/code}}. | ||
| 5 | 1. Add the ##HTTPS## block to ##/etc/apache2/sites-available/xwiki.conf##, carrying every proxy directive of the port ##80## block:((( | ||
| 6 | {{code language="apacheconf"}} | ||
| 7 | <VirtualHost *:443> | ||
| 8 | ServerName wiki.example.com | ||
| 9 | |||
| 10 | SSLEngine on | ||
| 11 | SSLCertificateFile /path/to/certificate | ||
| 12 | SSLCertificateKeyFile /path/to/privatekey | ||
| 13 | |||
| 14 | ErrorLog ${APACHE_LOG_DIR}/xwiki-error.log | ||
| 15 | CustomLog ${APACHE_LOG_DIR}/xwiki-access.log combined | ||
| 16 | |||
| 17 | RedirectMatch ^/$ /xwiki/ | ||
| 18 | |||
| 19 | <Location /xwiki> | ||
| 20 | Require all granted | ||
| 21 | </Location> | ||
| 22 | |||
| 23 | AllowEncodedSlashes NoDecode | ||
| 24 | |||
| 25 | RequestHeader unset Forwarded | ||
| 26 | RequestHeader unset X-Forwarded-Host | ||
| 27 | RequestHeader unset X-Forwarded-Proto | ||
| 28 | RequestHeader set X-Forwarded-Proto "https" | ||
| 29 | |||
| 30 | ProxyRequests Off | ||
| 31 | ProxyPreserveHost On | ||
| 32 | |||
| 33 | ProxyPass /xwiki http://localhost:8080/xwiki nocanon upgrade=websocket | ||
| 34 | ProxyPassReverse /xwiki http://localhost:8080/xwiki | ||
| 35 | </VirtualHost> | ||
| 36 | {{/code}} | ||
| 37 | ))) | ||
| 38 | 1. Replace the body of the port ##80## block in the same file with a redirect to ##HTTPS##:((( | ||
| 39 | {{code language="apacheconf"}} | ||
| 40 | <VirtualHost *:80> | ||
| 41 | ServerName wiki.example.com | ||
| 42 | |||
| 43 | AllowEncodedSlashes NoDecode | ||
| 44 | |||
| 45 | RewriteEngine On | ||
| 46 | RewriteCond %{REQUEST_URI} !^/\.well-known | ||
| 47 | RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L,NE] | ||
| 48 | </VirtualHost> | ||
| 49 | {{/code}} | ||
| 50 | ))) | ||
| 51 | 1. Set ##xwiki.home## in the [[##xwiki.cfg## configuration file>>doc:documentation.xs.admin.configuration.WebHome]] to the public base address, scheme and trailing slash included and without the ##/xwiki## path: {{code language="none"}}xwiki.home=https://wiki.example.com/{{/code}}. | ||
| 52 | 1. Recommended: make the Servlet Container trust the forwarded headers as well, following [[Configure Tomcat to Find Proxy Headers>>doc:documentation.xs.admin.installation.methods.install-xwiki-war.configure-servlet-container.configure-tomcat.find-proxy-headers.WebHome]]. The wiki's own links do not depend on it — XWiki reads the headers itself — but it is what makes the container's view of the request match, so that its access log holds the reader's address rather than the proxy's. | ||
| 53 | 1. Check the configuration and reload Apache: {{code language="none"}}sudo apachectl configtest{{/code}} then {{code language="none"}}sudo systemctl reload apache2{{/code}}. | ||
| 54 | 1. Open {{code language="none"}}https://wiki.example.com{{/code}} in a browser. The browser reports the connection as secure, the plain ##HTTP## address redirects to it, and the wiki's own links all use {{code language="none"}}https://{{/code}}. |
