Multiple Apache name-based virtual hosts?

[grigutis]

Hi,

Thank you for this software!
I'm running an Apache server using name-based virtual hosts such as:

• service1.example.com
• service2.example.com
• etc…

I've successfully setup one of my services, but when I setup another, I just get the first service. I suspect this is because the TARGET doesn't include information about the original hostname that the client used and is just using http://localhost:port, then Apache is just offering the first virtual host that matches. I think this might be related to #555.

Any suggestions? Any way I can specify a hostname variable for the TARGET? Otherwise I suppose I'd have to run multiple Anubis instances (one per service).

[grigutis]

I just realized that specifying a hostname in the TARGET won't work. At least it didn't work like I had assumed. I had to create separate instances along with different listening and targeting ports. Unless I'm doing something wrong.

[Xe]

There's not really a good answer here until #555 is addressed, which will require some re-thinking and major refactoring. Multiple Anubis instances is the best solution I have right now.

[GingkoFr]

I don't understand exactly what you mean by “I've successfully setup one of my services, but when I setup another, I just get the first service.”
What happens exactly if you set up two virtual hosts using the same Anubis instance, which invalidates that configuration?
I just tried to do this (BUT with some other alterations, see #966 — just in case it's relevant), and it seems to work for me.

I'm guessing Anubis follows the hostname with the request, and normally, that's all Apache needs to select a virtual host, right?
Or maybe there's some Anubis data getting mixed up that I haven't noticed yet?

Or maybe the issue has been fixed since June 30th? :-)

[grigutis]

I don't fully understand your particular configuration, but as I understand it, Anubis doesn't pass the hostname from the original request. The default Anubis TARGET is http://localhost:3923, so really http://localhost:3923 is what is going back to Apache, not http://my.fancy.domain:3923. If you use only one Anubis instance, have only one Apache listener for 127.0.0.1:3923, and have multiple name-based virtual hosts, then they will all be routed to one <VirtualHost *:3923> directive (I assume whichever is evaluated first). Specifying multiple <VirtualHost *:3923> stanzas with different ServerName directives didn't work for me.

But creating separate Anubis instances with unique BIND and TARGET ports did (along with separate listener ports in Apache of course).

[GingkoFr]

All my Apache websites are configured with a custom log containing the format item “%{Host}i”, which writes the hostname actually used to select the virtual host.
And actually, all calls to my virtual hosts for the same site goes intermixed into the same log files, with the same log configuration.
It means that all calls passing the Anubis test write two lines, sometimes even three if a http call was first redirected to https, into that single log file.
We are obviously not at the heart of the height of elegance, but it still allows us to check quite a few things.

And especially this one:

Anubis DOES pass the hostname from the original request.

At least for the version I use (1.21.3).

The Anubis + Apache configuration page tells to include the following directive:

ProxyPreserveHost On

Why would they ask this if the original host name wasn't passed?
This is exactly what this directive is for!!
(but of course, if you don't include it ……)

Anyway, the question that worries me a little is:
Apparently, Anubis does pass the hostname from the original request.
But does it use it itself, for example for not mixing the challenge for one site to the response of another one?

[damienvancouver]

I am sharing one Anubis instance between multiple apache Virtualhosts on a server, and it's working fine for me. All Apache 2.4 servers use NameVirtualHost by default and so should Just Work. If you are running an Apache version < 2.4, then you need to explicitly tell it that (e.g. NameVirtualHost 127.0.0.1:3001 ). But for 2.4+, as long as you have ProxyPreserveHost On then it should work by default.

With HTTP proxying, the hostname is usually specified in the HTTP HOST header. In terms of the proxy connection (what TARGET= points at), the only thing that really matters there is that it connects to the correct IP address (usually localhost) and port. Beyond that, it's the HOST header's job to tell Apache what site to get, which is inside the HTTP request. (HTTP is setup self-contained this way so that this proxying can happen multiple times and things will still work, even if some clients/servers are not aware of proxy layers).

So.. you should not need a separate anubis service for each site, unless you want to keep the challenge database separate between them (probably you just want to stop bots and that being shared per-apache is fine for you, or possibly even a desirable feature as it will block them on all sites if they fail challenges on one). I like to create one instance per Apache server and just leave it at that.