We got an Apache 2, working as Reverse Proxy to some Docker instances (we won't talk about the nginx vs Apache stuff here for the same reasons we won't talk about vi vs emacs vs xyz ;)) - and somehow we realized that our apps are a little bit too sensitive to allow them from any ip.<\/p>\n
First, we want to activate the needed modules. Normally that should not be necessary, but for sake of completeness: Secondly, we want to allow them only from trusted ips. We do redirect them to the docker instances via ProxyPass - but need to create an Location \/ \"catcher\" - otherwise we could not use the mod_authz to deny other ips :).<\/p>\n That way, hosts from other subnets than 192.168.1.0, 2.0 and 3.0 won't be able to access the proxy and therefore our app :)!<\/p>\n
\n
\nsudo a2enmod mod_authz_core
\nsudo a2enmod mod_authz_host
\n<\/code><\/p>\n<VirtualHost *:80>\r\nServerAdmin johndoe@example.com\r\nServerName hex.example.com\r\nServerAlias hex\r\n\r\nRedirectMatch ^\/$ https:\/\/example.com\r\n\r\n<Location \/ >\r\n<RequireAll>\r\nRequire ip 192.168.1.0\/24 192.168.2.0\/24 192.168.3.0\/24\r\n<\/RequireAll>\r\n<\/Location>\r\n\r\nProxyPass \"\/\" \"http:\/\/127.0.0.1:8020\/\"\r\nProxyPassReverse \"\/\" \"http:\/\/127.0.0.1:8020\/\"\r\n\r\n<\/VirtualHost>\r\n\r\n<VirtualHost *:443>\r\nServerAdmin johndoe@example.com\r\nServerName hex.example.com\r\nServerAlias hex\r\n\r\n<Location \/ >\r\n<RequireAll>\r\nRequire ip 192.168.1.0\/24 192.168.2.0\/24 192.168.3.0\/24\r\n<\/RequireAll>\r\n<\/Location>\r\n\r\nProxyPass \"\/\" \"http:\/\/127.0.0.1:8020\/\"\r\nProxyPassReverse \"\/\" \"http:\/\/127.0.0.1:8020\/\"\r\n\r\n# Alias \/static \/srv\/example_sw\/sw\/public_html\/\r\n\r\nSSLEngine on\r\nSSLCertificateFile \/etc\/ssl\/certs\/hex.example.com.pem\r\nSSLCertificateKeyFile \/etc\/ssl\/private\/hex.example.com.key\r\nSSLCertificateChainFile \/etc\/ssl\/chains\/example-ca-chain.pem\r\n\r\n<\/VirtualHost><\/pre>\n