主页 / server / 问题 / 1089250
Accepted
Toorero
Asked: 2022-01-07 16:55:43 +0800 CST

用于 SSH 隧道的 Apache 反向代理

  • 772

我想为在本地网络中运行的 Home-Assistant(hass) 实例设置一个 Apache 反向代理。

我将本地 hass 实例的流量通过隧道传输到远程服务器ssh -N [email protected] -R 8123:localhost:8123。

现在我尝试在 Apache 中设置一个普通的反向代理：

<VirtualHost *:443>
    ServerName hass.example.com

    SSLEngine On

    # If you manage SSL certificates by yourself, these paths will differ.
    SSLCertificateFile fullchain.pem
    SSLCertificateKeyFile privkey.pem

    SSLProxyEngine on
    SSLProxyProtocol +TLSv1.2 +TLSv1.3
    SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyVia On
    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
    
            
    # Proxy all traffic to hass
    ProxyPass / http://localhost:8123/ nocanon
    ProxyPassReverse / http://localhost/
    ErrorLog ${APACHE_LOG_DIR}/hass.example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/hass.example.com-access.log combined
    <IfModule security2_module>
        SecRuleEngine off
    </IfModule>
</VirtualHost>

<VirtualHost *:80>
    ServerName hass.example.com

    Redirect permanent / "https://hass.example.com"

    ErrorLog ${APACHE_LOG_DIR}/hass.example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/hass.example.com-access.log combined
</VirtualHost>

可悲的是，如果我尝试打开hass.example.com，浏览器会以400: Bad Request.

ssh ssh-tunnel apache-2.4 apache2

1 个回答

  1. Best Answer

    这一切都归结为Home-Assistant 阻止反向代理尝试，并且您还必须代理 websocket 请求。

    调整后的 hass-config ( config/configuration.yaml):

    http:
  use_x_forwarded_for: true
  trusted_proxies:
  - ::1
  - 127.0.0.1
  ip_ban_enabled: true
  login_attempts_threshold: 5

    阿帕奇配置：

    <VirtualHost *:443>
    ServerName hass.example.com

    SSLEngine On

    # If you manage SSL certificates by yourself, these paths will differ.
    SSLCertificateFile fullchain.pem
    SSLCertificateKeyFile privkey.pem

    SSLProxyEngine on
    SSLProxyProtocol +TLSv1.2 +TLSv1.3
    SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyVia On
    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
    
            
    # Proxy all traffic to hass
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket
    RewriteRule /(.*) ws://localhost:8123/$1 [P]
    RewriteCond %{HTTP:Upgrade} !=websocket
    RewriteRule /(.*) http://localhost:8123/$1 [P]
    ProxyPassReverse / http://localhost:8123


    ErrorLog ${APACHE_LOG_DIR}/hass.example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/hass.example.com-access.log combined
    <IfModule security2_module>
        SecRuleEngine off
    </IfModule>
</VirtualHost>

<VirtualHost *:80>
    ServerName hass.example.com

    Redirect permanent / "https://hass.example.com"

    ErrorLog ${APACHE_LOG_DIR}/hass.example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/hass.example.com-access.log combined
</VirtualHost>
    • 0

相关问题