Confluence Apache2 Proxy Issue

[Cang Ta]

Hello,

I am trying to configure Confluence through an Apache Proxy, using this guide but I have some issues.

In server.xml if I use the direct HTTPS connector as:

<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
           maxThreads="48" minSpareThreads="10"
           enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           scheme="http" proxyName="team.domain.com" proxyPort="80"/>

And apache2 virtual host config:

<VirtualHost *:80>
  ServerName team.domain.com

  ProxyRequests Off
  ProxyPreserveHost On

  RewriteEngine On
  RewriteCond %{REQUEST_URI} !^/synchrony
  RewriteRule ^/(.*) http://team.domain.com:8090/$1 [P]

  <Proxy *>
    Require all granted
  </Proxy>

  ProxyPass /synchrony http://team.domain.com:8091/synchrony

  <Location /synchrony>
    Require all granted
    RewriteEngine on
    RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
    RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
    RewriteRule .* ws://team.domain.com:8091%{REQUEST_URI} [P]
  </Location>

  ProxyPass / http://team.domain.com:8090
  ProxyPassReverse / http://team.domain.com:8090

  <Location />
    Require all granted
  </Location>
</VirtualHost>

But whenever I go to http://team.domain.com always got redirect to https://domain.com.

I'm using DigitalOcean WordPress OneClick VPS.

Here is my apache2 `000-default.conf` default virtual hosts config:

<VirtualHost *:80>
  ServerAdmin webmaster@localhost
  DocumentRoot /var/www/html

  <Directory /var/www/html/>
    Options FollowSymLinks
    AllowOverride All
    Require all granted
  </Directory>

  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined

  RewriteEngine on
  RewriteCond %{SERVER_NAME} =domain.com [OR]
  RewriteCond %{SERVER_NAME} =www.domain.com
  RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

Could anyone please help. 

Thank you so much.

[Kurt Klinner]

@Cang Ta 

Hi Cang

looks like the Rewrite rule in the default config is execute

RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

Are you running any other services using https?

If yes, than an option could be be to run confluence in a different context and have a dedicated rewrite rule for that.

Cheers

Kurt

[Cang Ta]

Hi Kurt,

Yes, I'm running a WordPress website using https.

Are there any options that I can run confluence without context? For example: running confluence with https too. Is it able to do that?

Thank you for your quick reply.

[Kurt Klinner]

@Cang Ta 

Absolutely, this is possible

https://confluence.atlassian.com/doc/running-confluence-behind-nginx-with-ssl-858772080.html

shows how to configure that by using nginx 

https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html contains also interesting information

Cheers

Kurt

[Cang Ta]

I tried to comment out

RewriteCond %{SERVER_NAME} =domain.com [OR]
RewriteCond %{SERVER_NAME} =www.domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

But still no luck :(

When trying to access https://team.domain.com I got the error

Service Unavailable

The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Checking the log I saw 

[Mon May 13 18:45:23.841902 2019] [proxy:error] [pid 3363] (111)Connection refused: AH00957: HTTP: attempt to connect to IP:8090 (team.domain.com) failed
[Mon May 13 18:45:23.842124 2019] [proxy:error] [pid 3363] AH00959: ap_proxy_connect_backend disabling worker for (team.domain.com) for 0s
[Mon May 13 18:45:23.842211 2019] [proxy_http:error] [pid 3363] [client other_IP:50362] AH01114: HTTP: failed to make connection to backend: team.domain.com 

I've already googled and tried some suggestion from stackoverflow but nothing works :( 

[Kurt Klinner]

@Cang Ta 

Can you ensure that the ports are reachable (8090, etc) from where apache server is running at e.g via telnet team.domain.com 8090

Just thinking if you might have firewall rules in place blocking the access

Cheers

Kurt