paivana.conf (1572B)
1 <!-- 2 Make sure to enable the following Apache modules before 3 integrating this into your configuration: 4 5 # a2enmod proxy 6 # a2enmod proxy_http 7 # a2enmod headers 8 --> 9 10 <Location "/"> 11 # paivana-httpd is started with -f (see paivana-httpd.service), so it 12 # takes the client address for the access cookie from the forwarding 13 # headers. mod_proxy's ProxyAddHeaders (on by default) *appends* the 14 # real client to any X-Forwarded-For the client itself sent, which 15 # would leave the client in control of the leftmost entry -- and thus 16 # of its own identity. Drop the client's copies first so that what 17 # mod_proxy adds is the only thing paivana-httpd sees. 18 # 19 # If this Apache is itself behind another proxy, remove these and 20 # configure mod_remoteip (RemoteIPHeader / RemoteIPInternalProxy) for 21 # that hop instead. 22 RequestHeader unset X-Forwarded-For 23 RequestHeader unset X-Forwarded-Proto 24 RequestHeader unset X-Forwarded-Host 25 RequestHeader unset X-Forwarded-Port 26 RequestHeader unset Forwarded 27 28 # RFC 7239, which paivana-httpd prefers over the X-Forwarded-* headers 29 # mod_proxy adds. Apache emits no Forwarded of its own, so build the 30 # element here. "set" rather than "append": this is the outermost hop, 31 # so a client-supplied element must not survive. Note that 32 # %{REMOTE_ADDR}e yields an unbracketed IPv6 address where RFC 7239 ยง6 33 # asks for for="[...]"; paivana-httpd accepts both. 34 RequestHeader set Forwarded "for=%{REMOTE_ADDR}e;proto=%{REQUEST_SCHEME}e;host=%{HTTP_HOST}e" 35 36 ProxyPass "unix:/var/lib/paivana/httpd/paivana.sock|http://example.com/" 37 </Location>