Skip to content

Commit 1728e26

Browse files
matifalimatifali
committed
docs: apache reverse proxy
1 parent 6e3330a commit 1728e26

File tree

2 files changed

+121
-0
lines changed

2 files changed

+121
-0
lines changed

‎docs/admin/configure.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ subdomain that resolves to Coder (e.g. `*.coder.example.com`).
4747
The Coder server can directly use TLS certificates with `CODER_TLS_ENABLE` and accompanying configuration flags. However, Coder can also run behind a reverse-proxy to terminate TLS certificates from LetsEncrypt, for example.
4848

4949
- Example: [Run Coder with Caddy and LetsEncrypt](https://github.com/coder/coder/tree/main/examples/web-server/caddy)
50+
- Apache: [Run Coder with Apache and LetsEncrypt](https://github.com/coder/coder/tree/main/examples/web-server/apache)
5051

5152
## PostgreSQL Database
5253

‎examples/web-server/apache/README.md

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# How to use Apache as a reverse-proxy with LetsEncrypt
2+
3+
## Requirements
4+
5+
1. Start a Coder deployment with a wildcard subdomain. See [this guide](https://coder.com/docs/v2/latest/admin/configure#wildcard-access-url) for more information.
6+
7+
2. Configure your DNS provider to point your YOUR_SUBDOMAIN and \*.YOUR_SUBDOMAIN to your server's public ip.
8+
9+
> For example, to use `coder.example.com` as your subdomain, configure `coder.example.com` and `*.coder.example.com` to point to your server's public ip. This can be done by adding A records in your DNS provider's dashboard.
10+
11+
3. Install Apache (assuming you're on Debian/Ubuntu):
12+
13+
```console
14+
sudo apt install apache2
15+
```
16+
17+
4. Stop Apache service and disable default site:
18+
19+
```console
20+
sudo a2dissite 000-default.conf
21+
sudo systemctl stop apache2
22+
```
23+
24+
## Install and configure LetsEncrypt Certbot
25+
26+
1. Install LetsEncrypt Certbot: Refer to the [CertBot documentation](https://certbot.eff.org/instructions?ws=other&os=pip&tab=wildcard)
27+
28+
## Create DNS provider credentials
29+
30+
1. Create an API token for the DNS provider you're using: e.g [CloudFlare](https://dash.cloudflare.com/profile/api-tokens) with the following permissions:
31+
32+
- Zone - DNS - Edit
33+
34+
2. Create a file in `.secrets/certbot/cloudflare.ini` with the following content:
35+
36+
```ini
37+
dns_cloudflare_api_token = YOUR_API_TOKEN
38+
```
39+
40+
3. Set the correct permissions:
41+
42+
```console
43+
sudo chmod 600 ~/.secrets/certbot/cloudflare.ini
44+
```
45+
46+
## Create the certificate
47+
48+
1. Create the wildcard certificate:
49+
50+
```console
51+
sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini -d coder.example.com -d *.coder.example.com
52+
```
53+
54+
## Configure Apache
55+
56+
> This example assumes Coder is running locally on `127.0.0.1:3000` for the subdomain `YOUR_SUBDOMAIN` e.g. `coder.example.com`.
57+
58+
1. Create Apache configuration for Coder:
59+
60+
```console
61+
sudo nano /etc/apache2/sites-available/coder.conf
62+
```
63+
64+
2. Add the following content:
65+
66+
```apache
67+
<VirtualHost *:443>
68+
ServerName YOUR_SUBDOMAIN
69+
ServerAlias *.YOUR_SUBDOMAIN
70+
ErrorLog ${APACHE_LOG_DIR}/error.log
71+
CustomLog ${APACHE_LOG_DIR}/access.log combined
72+
73+
ProxyPass / http://127.0.0.1:3000/
74+
ProxyPassReverse / http://127.0.0.1:3000/
75+
ProxyRequests Off
76+
ProxyPreserveHost On
77+
78+
# SSL configuration
79+
SSLCertificateFile /etc/letsencrypt/live/YOUR_SUBDOMAIN/fullchain.pem
80+
SSLCertificateKeyFile /etc/letsencrypt/live/YOUR_SUBDOMAIN/privkey.pem
81+
</VirtualHost>
82+
```
83+
84+
> Don't forget to change:
85+
> `YOUR_SUBDOMAIN` by your (sub)domain e.g. `coder.example.com`
86+
87+
3. Enable the site:
88+
89+
```console
90+
sudo a2ensite coder.conf
91+
```
92+
93+
4. Restart Apache:
94+
95+
```console
96+
sudo systemctl restart apache2
97+
```
98+
99+
## Refresh certificates automatically
100+
101+
1. Create a new file in `/etc/cron.weekly`:
102+
103+
```console
104+
sudo touch /etc/cron.weekly/certbot
105+
```
106+
107+
2. Make it executable:
108+
109+
```console
110+
sudo chmod +x /etc/cron.weekly/certbot
111+
```
112+
113+
3. And add this code:
114+
115+
```sh
116+
#!/bin/sh
117+
sudo certbot renew -q
118+
```
119+
120+
And that's it, you should now be able to access Coder at `https://YOUR_SUBDOMAIN`!

0 commit comments

Comments
 (0)