Preface
Basically, all applications deployed in the home data center are ultimately published externally in a unified manner through a reverse proxy. This has the same significance as configuring a reverse proxy on a cloud host, with the only difference being that the 443 port cannot be used for publishing. Since I am using the aaPanel Linux panel to implement the reverse proxy, this article will take the aaPanel Linux panel as an example to briefly describe how to configure a reverse proxy for a domain namewww.example.comand the steps to enable HTTPS.
It is recommended that everyone use HTTPS; HTTP should no longer be used. On one hand, HTTP is indeed insecure, and on the other hand, many browsers display an insecure warning when accessing HTTP, which looks very annoying~~
Add site
Select "Website" - "Add Site":
If it is a cloud host with a public IP and the domain name has been ICP-filed, then the 443 port is available, and there is no need to append a port after the domain name in the image above; if it is home broadband or a non-ICP-filed cloud host, you can only use a non-443 port (44443 is just an example, you can fill in any non-443, non-80, and other non-sensitive ports, as long as the port is reachable, but preferably easy to remember~), and finally click ”Submit“ in the bottom right corner.
Set up SSL certificate
Regarding obtaining SSL certificates, there are 2 ways:
Manual application
At various cloud providers, as long as you purchase a domain name, you can get a certain number of free 1-year certificate quotas (usually 20). The following takes Alibaba Cloud and Tencent Cloud as examples to illustrate the application location.
Alibaba Cloud:
The application location is under "Digital Certificate Management Service" - "SSL Certificates" - "Free Certificates" - "Create Certificate":
Alibaba Cloud has a quota of 20 free certificates per year, and I only have 1 left...
Tencent Cloud:
The application location is under "SSL Certificates" - "My Certificates" - "Free Certificates" - "Apply for Free Certificate":
It says 50, but Tencent domains can only use 20, which is the same as Alibaba Cloud.
After the certificate is issued, if you want to download it, download the Nginx version:
Automatic application
This mainly refers to Let's Encrypt, which allows you to apply for a free certificate valid for 3 months and can be automatically renewed. However, a main domain name can only be applied for 5 times within 168 hours; once reached, you can only wait for 168 hours.
The interface for successful site creation is as follows:
Click ”Settings“ in the red box on the right in the image above to enter the site settings interface:
Click SSL in the red box on the left in the image above, and the interface is as follows:
If you are manually adding an SSL certificate, at the current certificate position in the "red box" in the image above, unzip the downloaded Nginx certificate and open thewww.example.com.keyfile, copy all its content into the private key (KEY) in the red box on the bottom left of the image above; open thewww.example.com.pemfile (actually, the contents of .pem and .crt files are the same), copy all its content into the certificate (PEM) in the red box on the bottom right of the image above, and then click the green button below "Save and Enable Certificate".
If you want to useLet's Encryptto automatically apply for an SSL certificate, click the Let's Encrypt tab, as shown below:
It is recommended to use DNS verification as the verification method, because if the API of the DNS service provider is correctly configured, such as Alibaba Cloud DNS and Tencent Cloud DnsPod APIs, Let's Encrypt can automatically renew before the certificate expires, theoretically meaning you never have to worry about SSL certificate expiration. Finally, click the green "Apply" button below, and normally, after a short wait, the SSL certificate will be automatically applied for and obtained:
Modify site configuration file (optional)
The reason why this is optional is whether there is a legitimate, ICP-filed 443 port as mentioned earlier. If there is, then this step is not needed; if not, this step is mandatory.
After setting up the SSL certificate in the previous section, the content of the configuration file is as shown below:
As shown in the red box on the right in the image above, by default, aaPanel places the SSL listening on port 443. If there is a legitimate 443 port, this is of course fine, but if not, this will directly prevent external browsers from establishing an SSL connection. Therefore, you need to change 443 to the port you configured, which is port 44443 in this article, so the modified content is as follows:
You only need to change this one place, and then click the green "Save" button below.
Set up reverse proxy
Finally, we enter the main topic of this article: setting up the reverse proxy... Everything before was just preparation~.
Click "Reverse Proxy" in the red box on the left in the image above, and the following interface will appear:
Click "Add Reverse Proxy" in the red box in the image above, and the following interface will appear:
If the IP of the intranet application is 192.168.1.100 and the port is 8000, the correct configuration is as follows:
"There is not much to say about "Target URL", but here I will mention the sent domain name and content replacement.
The default value of the sent domain name, $host, generally does not need to be changed. This means passing the domain name accessed by your browser, which in this article iswww.example.compassed to the application corresponding to the target URL. Many applications do not care about this. However, there are some special applications, such as building COS with MinIO (see article:Docker Series: Building a Private COS Platform Based on MinIO), where its deployed Docker only recognizes host 127.0.0.1 (very speechless), so for MinIO, the sent domain name cannot use the default value. Below is my configuration:
There are also some other applications, such as WordPress and Nextcloud, which require the access domain name to be hardcoded directly inside the application. These may require modifying the sent domain name.
Content replacement, which is quite useful in some special occasions. For example, the free version pages of some software have many words like "pro", and you can directly use content replacement to replace "pro" with blank space or other words. If you are interested, you can try this.
Note: This article mainly describes the specific operating steps of using the aaPanel Linux panel to build a reverse proxy, without involving too much elaboration on reverse proxy theory. If you want to further understand the role and working method of reverse proxies, you can refer to my other two articles:Home Data Center Series: Application Publishing - Reverse Proxy Edition (Part 1)和Home Data Center Series: Application Publishing - Reverse Proxy Edition (Part 2)。