Wiki source code of Reverse Proxy and SSH Tunneling
Last modified by Eleni Cojocariu-testing account on 2026/08/18 15:05
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | [[Proxying>>doc:documentation.xs.admin.installation.http-reverse-proxy.WebHome]] a wiki that runs on a machine with no public address takes a second hop: a reverse SSH tunnel to a server that has one. The tunnel is opened by the local machine, outwards, which is what makes the arrangement work behind a firewall that allows no incoming connection and without a fixed public IP address: | ||
| 2 | |||
| 3 | {{code language="none"}} | ||
| 4 | ssh -R 8080:127.0.0.1:8080 server | ||
| 5 | {{/code}} | ||
| 6 | |||
| 7 | {{plantuml}} | ||
| 8 | @startuml | ||
| 9 | !theme bluegray | ||
| 10 | skinparam componentStyle rectangle | ||
| 11 | left to right direction | ||
| 12 | |||
| 13 | actor "Reader" as USER | ||
| 14 | |||
| 15 | package "Remote server, public address" { | ||
| 16 | component "**Reverse proxy**\nNginX serving wiki.example.com" as PROXY | ||
| 17 | component "**Tunnel entrance**\n127.0.0.1:8080 on the remote server,\nbound to its loopback interface only" as ENTRY | ||
| 18 | } | ||
| 19 | |||
| 20 | package "Local machine, no public address" { | ||
| 21 | component "**XWiki**\nServlet container on 127.0.0.1:8080" as XWIKI | ||
| 22 | } | ||
| 23 | |||
| 24 | USER --> PROXY : HTTPS, port 443 | ||
| 25 | PROXY --> ENTRY : proxy_pass to 127.0.0.1:8080 | ||
| 26 | ENTRY --> XWIKI : forwarded over the SSH connection | ||
| 27 | XWIKI ..> ENTRY : ssh -R, opened outwards\nby the local machine | ||
| 28 | @enduml | ||
| 29 | {{/plantuml}} | ||
| 30 | |||
| 31 | The port the tunnel opens on the remote server is bound to that server's loopback interface, not to its public one, so nothing reaches the wiki through it from outside. Publishing it is the reverse proxy's job, and the proxy is configured as it is on any other host, following [[Configure NginX Server as a Proxy on a Linux OS>>doc:documentation.xs.admin.installation.http-reverse-proxy.nginx-key-configurations.configure-nginx-server-linux.WebHome]] with ##proxy_pass## naming the tunnelled port: to XWiki the request arrives from the proxy, exactly as it would if the wiki ran on the same machine. | ||
| 32 | |||
| 33 | This is a development and temporary-deployment arrangement. Every request crosses an SSH connection that nothing restarts on its own, so a permanent wiki is better served from a host that carries it directly. |
