Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add rewrites for ssl so apache behaves properly #1124

Merged
merged 6 commits into from Oct 1, 2018

Conversation

rfay
Copy link
Member

@rfay rfay commented Sep 23, 2018

The Problem/Issue/Bug:

@ondrogo in Typo3 slack pointed out that with apache-fpm or apache-cgi he was unable to log into the backend. The reason ended up being that both Apache and TYPO3 were redirecting to plain https, losing the context in the process.

Apache is not very good at being on the receiving end of a reverse proxy. But there are workarounds, as in this PR. You have to convince mod_dir not to redirect to http when operating in https, and you have to make sure that the HTTPS environment variable gets propagated to php.

The base problem is described in http://httpd.apache.org/docs/2.4/mod/core.html#servername:

Sometimes, the server runs behind a device that processes SSL, such as a reverse proxy, load balancer or SSL offload appliance. When this is the case, specify the https:// scheme and the port number to which the clients connect in the ServerName directive to make sure that the server generates the correct self-referential URLs.

Unfortunately, we are supporting both http and https at the same time, so can't use the ServerName workaround.

The internet is not all that good at solving this problem for us, but these two obscure links provided hints:

How this PR Solves The Problem:

It tries to do those things.

Manual Testing Instructions:

You can either use the full ddev download from Circleci or just use webimage: drud/ddev-webserver:20180922_apache_https in your config.yaml.

  • Nontrivial explorations on TYPO3 with apache-cgi and apache-fpm, especially using the backend.
  • Nontrivial explorations of Drupal with apache-cgi and apache-fpm
  • Make sure to use custom ports on both http and https as another permutation.

Automated Testing Overview:

We may be able to add cases for this into apache-specific tests, but I'm not sure.

Related Issue Link(s):

Release/Deployment notes:

@rfay rfay added this to the v1.3.0 milestone Sep 23, 2018
@rfay rfay self-assigned this Sep 23, 2018
@peterbenke
Copy link

Adding webimage: drud/ddev-webserver:20180922_apache_https to my config.yaml solved the problem for me. Thank you!

@ogrosko
Copy link

ogrosko commented Sep 25, 2018

Testing it with webimage: drud/ddev-webserver:20180922_apache_https and clean Typo3 v9.4 all works fine ;)

Copy link
Contributor

@andrewfrench andrewfrench left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm able to interact with sites configured to use Apache over https, this looks good to me.

@rfay
Copy link
Member Author

rfay commented Sep 25, 2018

It's worth considering adding a test for this one.

Copy link
Contributor

@andrewfrench andrewfrench left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-approving after test changes. Inspecting redirect destinations seems sturdy enough for me at the moment, but we could investigate using something like headzoo/surf if that gets brought back into the deeper CMS test interaction stuff.

@rfay rfay merged commit 4940a33 into ddev:master Oct 1, 2018
@rfay rfay deleted the 20180922_apache_https branch October 1, 2018 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants