Apache reverse proxy + bitwarden

[javfg]

Hi!

I'm having problems configuring a bitwarden docker behind a reverse apache proxy. I don't know if the problem is in the proxy config or bitwarden, but there are other services working properly using that proxy.

The configuration is mostly default, I'm using a self signed key against the proxy, and the proxy has a letsencrypt certificate to be connected from outside.

Also, I selected yes when asked if using a reverse proxy in the bitwarden setup script, and I am using 8444 port for ssl, so it's not the same as proxy port (443).

I get constant 503 errors when browsing bitwarden, redering it unusable. Some times it's the whole web, other times in scripts, from time to time it works properly.

Here is the vhost config in the proxy:

<VirtualHost *:80>
  ServerName bitwarden.[...]

  ErrorLog ${APACHE_LOG_DIR}/bitwarden.error.log
  CustomLog ${APACHE_LOG_DIR}/bitwarden.access.log combined

  RewriteEngine on
  RewriteCond %{HTTP_HOST} ^bitwarden.[...]
  RewriteRule ^/(.*)$ https://bitwarden.[...]/$1 [L,R=301]
</VirtualHost>

<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerName bitwarden.[...]
    #DocumentRoot /var/www/default

    ServerSignature Off

    SSLEngine On
    SSLProxyEngine On
    ProxyVia On
    ProxyRequests Off
    ProxyPass / https://192.168.100.55:8444/
    ProxyPassReverse / https://192.168.100.55:8444/

    ProxyPreserveHost On
    SSLProxyCheckPeerCN Off
    SSLProxyCheckPeerName Off

    <Proxy *>
      Options FollowSymLinks MultiViews
      AllowOverride All
      Order allow,deny
      allow from all
    </Proxy>

    #LogLevel info ssl:warn

    ErrorLog ${APACHE_LOG_DIR}/bitwarden.error.log
    CustomLog ${APACHE_LOG_DIR}/bitwarden.access.log combined

    SSLCertificateFile /etc/letsencrypt/live/bitwarden.[...]/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/bitwarden.[...]/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
  </VirtualHost>
</IfModule>

[kspearrin]

Can you successfully access Bitwarden from https://192.168.100.55:8444/ ? I don't know much about apache, but I'd first confirm that Bitwarden is actually accessible.

[javfg]

Yes, I forgot to mention bitwarden works flawlessly bypassing the proxy.

[Mart124]

Works flawlessly here behind an Apache reverse proxy.
Quite same configuration as yours, however I'm not sure you need ProxyVia On. Try without ?
503 errors mean Apache failed to contact proxy target, 192.168.100.55:8444 here.

[c4539]

@javfg is this still an issue?

[javfg]

Sorry for abandoning the thread. I finally solved it by bypassing the apache proxy.

After trying many different ideas without finding a solution, I mirrored the scenario in another location and there was no problem with the proxy; so it must be some configuration quirk of the primary infrastructure.

Nothing to blame on Bitwarden.

Thanks for the help, you can close the issue.

[omnitekton]

Maybe someone will find useful this config from /etc/apache2/sites-available/ for bitwarden:
Bitwarden is accessible via HTTP. HTTPS is a result of Apache reverse proxy. Bitwarden is inside a docker container on a different machine than Apache.

<VirtualHost *:443>
		ProxyPreserveHost On
                ServerAdmin admin@<YOUR_DOMAIN>

                ErrorLog ${APACHE_LOG_DIR}/error.log
                CustomLog ${APACHE_LOG_DIR}/access.log combined

                ProxyPass "/" "http://192.168.80.49:449/"
                ProxyPassReverse  "/" "http://192.168.80.49:449/"

ServerName bitwarden.<YOUR_DOMAIN>
SSLCertificateFile /etc/letsencrypt/live/<YOUR_DOMAIN>/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/<YOUR_DOMAIN>/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

[yves-chevallier]

I have the same issue with Apache. With the following configuration I have an infinite loading from by browser:

<VirtualHost *:443>
  #SSLEngine On
  SSLProxyEngine On
  ServerName bitwarden.domain.io

  ProxyPass / https://localhost:2651/
  ProxyPassReverse / https://localhost:2651/

    ProxyPreserveHost On
    SSLProxyCheckPeerCN Off
    SSLProxyCheckPeerName Off

  SSLCertificateFile /etc/letsencrypt/live/bitwarden.domain.io/cert.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/bitwarden.domain.io/privkey.pem
</VirtualHost>