Tomcat behind Apache

[bensewell]

Alfresco is working fine internally.  My next move is to do some work to get Alfresco working externally.  I dont think that exposing Tomcat to the external world is appropriate so planning to configure Apache to sit in front of Alfresco.  This would mean that Apache would act a bit like a proxy server dealing with requests for Alfresco then passing the requests through Tomcat and then back out to the user. 

Just going to start doing some reading up on this.  But thought i'd put a post on here to see if any of you lot have any pointers, lessons learnt or anything else to speed up the process?

Many Thanks, Ben

[zaizi]

Hint: Search the forum!

[bensewell]

Will do but didnt know if there is any quick pointers.  Watch this space.

[konsultex]

Hi Ben,

I use Alfresco in Jboss on a server behind Apache httpd so it's almost the same.

I have this in httpd.conf (Linux)

     ProxyVia on
     ProxyRequests Off
     <Proxy *>        
       Order deny,allow
       Allow from all  
     </Proxy>    

     ProxyPass /alfresco http://localhost:9090/alfresco
     ProxyPassReverse /alfresco http://localhost:9090/alfresco

     ProxyPass /share http://localhost:9090/share
     ProxyPassReverse /share http://localhost:9090/share
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Note that I have port 9090 in use. You probably need to put 8080 in there.

So with this setup my external access is http://myserver/alfresco

[riyaz]

Hi,

I tried this and I get the login page but when I tried to login I get the following error.

Something's wrong with this page...

We may have hit an error or something might have been removed or deleted, so check that the URL is correct.

Alternatively you might not have permission to view the page (it could be on a private site) or there could have been an internal error. Try checking with your Alfresco administrator.

If you're trying to get to your home page and it's no longer available you should change it by clicking your name on the Alfresco toolbar.

[bensewell]

Magic!  Thanks

[bensewell]

Hello Peeps,

Right been doing some tinkering and gome some things working but not the way I wanted.

I tried setting it up using konsultex's straightforward rules but it didnt work out right for me.  I got the usual 503 page unavailable error.  So i then tried to add a virtual host with a rewrite rule on to divert from Apache to Tomcat.  This worked fine but in the real world i wouldnt be happy with the end users seeing the port number just the http://webaddress.co.uk. 

So now want to find out where i've gone wrong a bit with the proxypass/reverse rules or put something in front of the initial apache to tomcat to filter out the port numbers.

If i understand it right this is how its currently working:
apache running on port 80
Tomcat running on port 8080

User's Browser ->Apache:80 RW -> Tomcat:8080 -> Alfresco <->Tomcat:8080 ->Apache:80->User's Browser

I think i need it along the lines of
User's Browser ->Apache:80 RW -> Tomcat:8080 -> Alfresco <->Tomcat:8080 <-> Apache Cache -> User's Browser

I set it up using the following in httpd.conf.

Worked no proxying:

<VirtualHost *:80>
ServerName alfresco.localhost.com
RewriteEngine On
RewriteLogLevel 3
RewriteLog "/var/log/httpd/rewrite.log"
RewriteRule ^/(.*) http://XXX.XX.XXX.XXX:8080/share$1
</VirtualHost>

Didnt work with proxying:
ProxyVia on
ProxyRequests Off
<Proxy *>      
Order deny,allow
Allow from all
</Proxy>  

#Apache to Tomcat Alfresco Rule
ProxyPass /alfresco http://XXX.XX.XXX.XXX:8080/alfresco
ProxyPassReverse /alfresco http://XXX.XX.XXX.XXX:8080/alfresco

#Apache to Tomcat Share Rule
ProxyPass /share http://XXX.XX.XXX.XXX:8080/share
ProxyPassReverse /share http://XXX.XX.XXX.XXX:8080/share

[bensewell]

I tried something else as mentioned in this post:
http://forums.alfresco.com/en/viewtopic.php?f=9&t=22176

And this did work i.e. diverting users to the correct page, but the end user can still see the port number and so and so so not really ideal when the site is moved externally.

Does anyone know how to cache the web port etc and present the end user with just the page they requested minus the port number.  I dont want people to see the port number or it could present a security threat?  Maybe i'm being a bit too cautious?

[bensewell]

Configured and kind of working now. 

In the end used a AJP rule and added mod_jk into the modules.  Then setup two worker lines in the httpd.conf and added in one proxy pass rule.  My edits are below:

httpd.conf file
###settings for transferring data through proxy on another virtual host within Apache server###
# Load mod_jk module
# Update this path to match your modules location
LoadModule    jk_module  /etc/httpd/modules/mod_jk.so
# Where to find workers.properties
# Update this path to match your conf directory location (put workers.properties next to httpd.conf)
JkWorkersFile /etc/httpd/conf/workers.properties
# Where to put jk shared memory
# Update this path to match your local state directory or logs directory
JkShmFile     /var/log/httpd/mod_jk.shm
# Where to put jk logs
# Update this path to match your logs directory location (put mod_jk.log next to access_log)
JkLogFile     /var/log/httpd/mod_jk.log
# Set the jk log level [debug/error/info]
JkLogLevel    info
# Select the timestamp log format
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
# Send everything for context /examples to worker named worker1 (ajp13)
JkMount  /samples/* worker1
JkMount  /alfresco/* worker1
JkMount  /share/* worker1

<VirtualHost *:80>
   ServerName localhost
   ErrorLog /etc/httpd/logs/ajp.error.log
   CustomLog /etc/httpd/logs/ajp.log combined

   <Proxy *>
     AddDefaultCharset Off
     Order deny,allow
     Allow from all
   </Proxy>

   ProxyPass / ajp://localhost:8009/
   ProxyPassReverse / ajp://localhost:8009/

So now the site is accessible by typing http://servername/share and http://servername/alfresco and it works fine and strips out the port number.  That was bothering me for some reason.  Last thing i want to do now is tell Apache that if a user tries to hit the server on default port 80 to divert it to /share now the ajp bits and bobs are in place.

I did try to integrage my mod-rewrite work I did yesterday but must have done it wrong because it always goes to the default page.  If all fails i'll just put a simple re-direct php script in to divert the traffic back to share.