Apache + mod_proxy + mod_ssl - A good, secure reverse proxy

Having several offices in the company and one of our policy being to allow people to work from home, a lot of our services are available as web services. As we make heavy usage of virtualization, these websites are spread on many different virtual machines, depending on their requirements (PHP, Java, Python, Mysql, Postgresql...). With only a limited number of public IP addresses, we hence had the need for a HTTP reverse proxy.

Came the question: what would be the reverse proxy that would best fit our usage? We had a look at several alternatives: Varnish, Squid, Apache with mod_proxy, nginx, haproxy... The reasons that made us chose mod_proxy were the following:

• It is in main - So long-term supported, which is critical for a frontal webserver. As we have canonical support, we can rely on them so that business-critical bugs will be sorted.
• Very good documentation - most of the other solutions are badly documented (nginx documentation is in russian and part of it is non translated, squid documentation isn't great neither...)
• Easy configuration - a lot easier than varnish or squid...
• Low traffic: we don't have millions of hits a day; so even if maybe other reverse proxies have better pure performance, it is not our main point of interest.
• You get all the other apache modules with it: mod_rewrite, mod_cache, etc...

After several months of use, I am very happy with that choice. It runs on a quite low-end VM and the load rarely goes over 0.1.

After some weeks, we decided we wanted to improve security and purchased a wildcard SSL certificate. There is also a big advantage in using a reverse proxy to do encryption: the backend application doesn't have to support HTTPS - and you have a single way to configure it. In other words, it is easy (you just do the configuration once for the apache proxy, and don't have to configure it for every single HTTP server you may be running), and completely transparent for the backend.

Several months ago, many people pointed me at Pound - but it just wasn't needed, thanks to mod_ssl. In the end, what I am doing is mass name-based virtual hosting with SSL; which is apparently not recommended (throws warnings in the logs, any idea why?) but works like a charm. This is how one of my vhost declaration would look like:

<VirtualHost *:80>
	ServerName website.thehumanjourney.net

        # Rewrite all incoming http request from external IP to https
        RewriteEngine On
        RewriteCond %{REMOTE_ADDR} !^10.0.*$
        RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]

	ProxyPass / http://INTERNALIP/
        ProxyPassReverse / http://website.thehumanjourney.net/
	ProxyPassReverse / http://INTERNALIP/

        CustomLog /var/log/apache2/website.thehumanjourney.net.access.log combined
        ErrorLog /var/log/apache2/website.thehumanjourney.net.error.log
</VirtualHost>
<VirtualHost *:443>
 	ServerName website.thehumanjourney.net
      
        SSLEngine on
	SSLCertificateFile /etc/apache2/ssl/thehumanjourney.crt
	SSLCertificateKeyFile /etc/apache2/ssl/thehumanjourney.key

        ProxyPass / http://INTERNALIP/
        ProxyPassReverse / http://website.thehumanjourney.net/
        ProxyPassReverse / http://INTERNALIP/

       CustomLog /var/log/apache2/website.thehumanjourney.net.access.log combined
       ErrorLog /var/log/apache2/website.thehumanjourney.net.error.log
</VirtualHost>

The ProxyPassReverse is the bit of black magic that took me a while to figure out; but in the end, it is just if the website creates a redirection using its internal address, the proxy would convert it to the external address before passing it to the user.

Even with SSL, the CPU doesn't blink at all. Many people consider this as a bad choice as they associate apache with bad performances; but before you decide not to use apache as a reverse proxy because it is "slow" - ask yourself the question: do you really have the need for the X GB/s throughput that nginx or varnish may provide?