Possible to set-up Anubis in specific "behind a RP" config ?

[fbridebian]

Hello,

I'd like to implement Anubis in my current server configuration but I don't know whether or not it's possible :

User Machine -> Reverse Proxy with HTTPS and the SSL certificate -> VM with both Anubis and my Java Website

Due to complicated obligations in my organisation, I can't move my VM with my Java Website to the Reverse Proxy and I can't install anything on the Reverse Proxy with HTTPS and the SSL certificate.

With Apache2, I've tried something like :

# HTTP listener that forwards to Anubis
<VirtualHost *:80>
       ServerName mywebsite.domain.fr
       ServerAdmin webmaster@localhost
       DocumentRoot /var/www/html
       ErrorLog /var/log/apache2/mywebsiteanubis_error.log
       CustomLog /var/log/apache2/mywebsiteanubis_access.log combined

       # These headers need to be set or else Anubis will
       # throw an "admin misconfiguration" error.
       RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR}
       RequestHeader set X-Forwarded-Proto "https"

       ProxyPreserveHost On

       ProxyRequests Off
       ProxyVia Off

       # Replace 9000 with the port Anubis listens on
       ProxyPass / http://127.0.0.1:9000/
       ProxyPassReverse / http://127.0.0.1:9000/
</VirtualHost>

# Actual website config
<VirtualHost *:3001>
       ServerName mywebsite.domain.fr
       ServerAdmin webmaster@localhost
       DocumentRoot /var/www/html

       ProxyVia Off
       ProxyRequests Off
       ProxyTimeout 3600
       ProxyPreserveHost On

       ProxyPass /solr !
       ProxyPass / ajp://localhost:8009/ retry=0
       ProxyPassReverse / ajp://localhost:8009/
       ErrorLog /var/log/apache2/mywebsite_error.log
       CustomLog /var/log/apache2/mywebsite_access.log combined
</VirtualHost>

But after the challenge I end up with the following error :

502 Bad Gateway

I'm using Apache2 and Debian, and Anubis 1.18.0.

I'm not sure whether or not what I'm trying to do is feasible, maybe I'm simply stuck and my only solution would currently be to restrict IP traffic to internal IPs :-/

[kdkasad]

Yes, it should be possible to run Anubis in your case, at least from the description you've given. If the reverse proxy can reach the Java server, it should also have no issue reaching Anubis, which can forward to the Java server. Thus from the reverse proxy's perspective, it does not even need to know Anubis is there. (Whether that's the setup you decide to go with is up to you; that's just a proof-of-concept that it is possible.)

The 502 error likely means one of your services can't reach the next one. It could be a firewall/subnet issue, or it could just be as simple as getting the ports wrong.

[fbridebian]

Thanks, that gives me hope. I'll be in touch with the team in charge of the first Reverse Proxy with HTTPS and the SSL certificate to try to solve that 502 error.

[fbridebian]

Just got everything up and working !
The only problem was apparently coming from the Webserver which was under so much stress because of the overload of requests that it was unable to process with Anubis properly.
We first had to switch it to LAN only.
Now it's working, and the machine is back online.
Thanks again, great work !