Fork me on GitHub

## Introduction

A reverse-proxy is usually used to give a single one-point access to different services or applications. It is also used to handle TLS connections and then the required certificates.

The configuration of Silverpeas behind an Apache or an Nginx reverse-proxy is quite straightforward.
In this example we want to configure a reverse-proxy that is handling TLS and proxyfying a Silverpeas running in a Wildfly server on port 8000.

## Apache Configuration

Defines the configuration of your site as following. The [...] means your own specific configuration for your site and that isn't covered by this document.

        <VirtualHost site.domaine.tld:443>
              ServerName site.domaine.tld:443

              [...]
            SSLEngine On
            SSLProxyEngine On
            SSLCertificateFile PATH_OF_YOUR_CRT
            SSLCertificateKeyFile PATH_OF_YOUR_CERTIFICATE_KEY
            SSLCertificateChainFile  PATH_OF_YOUR_CERTIFICATE_CHAIN_PEM
            SSLVerifyClient None
            SSLCipherSuite !ADH:!DSS:!RC4:HIGH:+3DES
            SSLCompression Off
            SSLHonorCipherOrder On
            SSLProtocol all -SSLv2 -SSLv3

            ProxyTimeout 300
            ProxyVia Off
            ProxyRequests Off
            ProxyPreserveHost On

            # Silverpeas
            ProxyPass /weblib http://127.0.0.1:8000/weblib
            ProxyPassReverse /weblib http://127.0.0.1:8000/weblib
            ProxyPass /silverpeas http://127.0.0.1:8000/silverpeas
            ProxyPassReverse /silverpeas http://127.0.0.1:8000/silverpeas
            ProxyPass /website http://127.0.0.1:8000/website
            ProxyPassReverse /website http://127.0.0.1:8000/website
            ProxyPass /help_fr http://127.0.0.1:8000/help_fr
            ProxyPassReverse /help_fr http://127.0.0.1:8000/help_fr

            RewriteEngine On
            RewriteRule ^/$ /silverpeas [R,L]

            Header set Access-Control-Max-Age "1000"
            Header set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, X-STKN"
            # This parameter is important for Wildfly
            Header set X-Forwarded-Proto "https"

            [...]
        </VirtualHost>

## Configuring Nginx

Defines the configuration of your site as following. The [...] means your own specific configuration for your site and that isn't covered by this document.

        [...]

        server {
            listen 443;
            server_name site.domaine.tld;

            [...]

            ssl on;
            ssl_certificate_key PATH_OF_YOUR_CERTIFICATE_KEY;
            ssl_certificate     PATH_OF_YOUR_CERTIFICATE_CHAIN_PEM;
            ssl_stapling on;
            ssl_stapling_verify on;

            ssl_session_timeout 5m;
            ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
            ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
            ssl_prefer_server_ciphers on;
            client_max_body_size 2048M;

            location / {
                proxy_pass http://127.0.0.1:8000/;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Proto $scheme;
            }
            rewrite ^/$ /silverpeas break;

            [...]
         }

## Configuring Wildfly

### In a non TLS mode

Now, you just have to update one attribute of the HTTP listener of the Undertow Web server embedded in Wildfly. For doing, go to the `JBOSS_HOME/bin` directory and, run Wildfly in administration mode only, enable the proxy forwarding and then stop Wildfly:

            $ ./standalone.sh -c standalone-full.xml --admin-only &
            [...]
            $ ./jboss-cli.sh --connect -c "/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=proxy-address-forwarding,value=true)"
            {"outcome" => "success"}
            $ ./jboss-cli.sh --connect -c "/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=redirect-socket)"
            {"outcome" => "success"}
            $ ./jboss-cli.sh --connect -c "shutdown"

### In TLS mode

Now, you just have to create a configuration for a socket binding to handle TLS connections (here `proxy-https`) and then update the HTTP listener of the Undertow Web server embedded in Wildfly. For doing, go to the `JBOSS_HOME/bin` directory and, run Wildfly in administration mode only, create and use a socket binding for TLS connections, and enable the proxy forwarding, and then stop Wildfly:

              $ ./standalone.sh -c standalone-full.xml --admin-only &
              [...]
              $ ./jboss-cli.sh --connect -c "/socket-binding-group=standard-sockets/socket-binding=proxy-https:add(port=443)"
              {"outcome" => "success"}
              $ ./jboss-cli.sh --connect -c "/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=proxy-address-forwarding,value=true)"
              {"outcome" => "success"}
              $ ./jboss-cli.sh --connect -c "/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=redirect-socket,value=proxy-https)"
              {"outcome" => "success"}
              $ ./jboss-cli.sh --connect -c "shutdown"