Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ood-portal-generator should allow for different servername and redirect rules #73

Closed
wdpypere opened this issue Oct 1, 2019 · 3 comments · Fixed by #74
Closed

ood-portal-generator should allow for different servername and redirect rules #73

wdpypere opened this issue Oct 1, 2019 · 3 comments · Fixed by #74

Comments

@wdpypere
Copy link
Contributor

wdpypere commented Oct 1, 2019

We have a setup with ondemand behind an loadbalancer and proxy host.
The only way (I found) to make all the redirects generated by ood-portal-generator work (as in, point to the proxy) is to set the servername: proxyhostname in /etc/ood/config/ood-portal.yml.

But this also sets the servername in the apache virtualhost to the proxyhost:

<VirtualHost *:443>
  ServerName proxyhostname

Which creates the problem that apache warns that the ServerName and the name in the certificate for the host are different, and there is no valid SSL.

So I think it would be good to have an separate option in /etc/ood/config/ood-portal.yml to set the redirects.

@ericfranz
Copy link
Contributor

The portion of the template that uses @servername is:

<% if @ssl && @use_rewrites -%>
# Redirect all http traffic to the https Open OnDemand portal URI
# http://*:<%= @port %>
# #=> <%= @ssl ? "https" : "http" %>://<%= @servername || "localhost" %>:<%= @port %>
#
<VirtualHost *:80>
RewriteEngine On
RewriteRule ^(.*) <%= @ssl ? "https" : "http" %>://<%= @servername || "%{SERVER_NAME}" %>:<%= @port %>$1 [R=301,NE,L]
</VirtualHost>
<% end -%>
# The Open OnDemand portal VirtualHost
#
<VirtualHost *:<%= @port %>>
<%- if @servername -%>
ServerName <%= @servername %>
ErrorLog "<%= @logroot %>/<%= @servername %>_error<%= "_ssl" if @ssl %>.log"
CustomLog "<%= @logroot %>/<%= @servername %>_access<%= "_ssl" if @ssl %>.log" combined
<%- if @use_rewrites -%>
RewriteEngine On
RewriteCond %{HTTP_HOST} !^(<%= @servername %>(:<%= @port %>)?)?$ [NC]
RewriteRule ^(.*) <%= @ssl ? "https" : "http" %>://<%= @servername %>:<%= @port %>$1 [R=301,NE,L]
<%- end -%>
<%- end -%>

So if servername is "proxyhostname" you get:

# Redirect all http traffic to the https Open OnDemand portal URI
#     http://*:443
#     #=> https://proxyhostname:443
#
<VirtualHost *:80>
  RewriteEngine On
  RewriteRule ^(.*) https://proxyhostname:443$1 [R=301,NE,L]
</VirtualHost>

# The Open OnDemand portal VirtualHost
#
<VirtualHost *:443>
  ServerName proxyhostname

  ErrorLog  "logs/proxyhostname_error_ssl.log"
  CustomLog "logs/proxyhostname_access_ssl.log" combined

  RewriteEngine On

# The Open OnDemand portal VirtualHost
#
<VirtualHost *:443>
  ServerName proxyhostname

  ErrorLog  "logs/proxyhostname_error_ssl.log"
  CustomLog "logs/proxyhostname_access_ssl.log" combined

  RewriteEngine On
  RewriteCond %{HTTP_HOST} !^(proxyhostname(:443)?)?$ [NC]
  RewriteRule ^(.*) https://proxyhostname:443$1 [R=301,NE,L]

What would the name of the second option be called, and what would it affect? How would above output look different?

@wdpypere
Copy link
Contributor Author

wdpypere commented Oct 3, 2019

@ericfranz I made a PR for this (#74)
The ouput should look like

#
<VirtualHost *:80>
  RewriteEngine On
  RewriteRule ^(.*) https://proxyhostname:443$1 [R=301,NE,L]
</VirtualHost>

<VirtualHost *:443>
  ServerName servername

  ErrorLog  "logs/servername_error_ssl.log"
  CustomLog "logs/servername_access_ssl.log" combined

  RewriteEngine On
  RewriteCond %{HTTP_HOST} !^(proxyhostname(:443)?)?$ [NC]
  RewriteRule ^(.*) https://proxyhostname:443$1 [R=301,NE,L]

@wdpypere
Copy link
Contributor Author

wdpypere commented Oct 3, 2019

this enables us to have 1 proxy host and several backend portals, but all served from one URL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants