# Apache Reverse Proxy & VHosts (`10.2.0.4`)

Op host **`vmserver`** (`10.2.0.4`) draait Apache 2 direct als **Edge Reverse Proxy, TLS Terminator en OIDC Authentication Gateway** vóór zowel bare-metal hostdiensten als het Kubernetes cluster.

---

## 📂 Locatie & Synchronisatie

* **Host-pad (live configuratie)**: `/sites/vhosts/`
* **Git Repository**: [`cluster-infra/vhosts/`](file:///home/bart/git/cluster/cluster-infra/vhosts/) in `https://git.bnhmeijer.nl/bart/cluster-infra.git`
* **Certificaten (Let's Encrypt)**: `/etc/letsencrypt/live/thuus.bnhmeijer.nl/`
* **Certbot challenge root**: `/sites/certroot/.well-known`

---

## 🏗️ Architectuur: Apache als Edge Gateway

```mermaid
flowchart TD
    Client[Inkomend Verkeer / Browser] -->|Poort 80 / 443| Apache["Apache 2 (10.2.0.4)<br>/sites/vhosts/"]

    subgraph Apache Functionaliteit
        Apache -->|TLS / Let's Encrypt| SSL[SSL Termination]
        Apache -->|mod_auth_openidc| OIDC[OIDC Auth via login.bnhmeijer.nl]
    end

    subgraph Bare-Metal Host Services
        Apache -->|Proxy :3000| Gitea[Gitea git.bnhmeijer.nl]
        Apache -->|Proxy :8096| Jellyfin[Jellyfin /jellyfin]
        Apache -->|Proxy :8000 / :5000| Radio[Icecast & Radio Chicken]
        Apache -->|Proxy :8686, :7878, ...| ArrStack["*Arr Stack (Sonarr, Radarr, etc.)"]
        Apache -->|DocRoot /sites/nextcloud| Nextcloud[cloud.bnhmeijer.nl]
        Apache -->|Proxy 192.168.2.15:8123| HomeAssistant[ha.bnhmeijer.nl]
    end

    subgraph Kubernetes Cluster (vmserver:10.2.0.4)
        Apache -->|Proxy 127.0.0.1:32608<br>(Envoy Gateway NodePort)| EnvoyGW[Envoy Gateway NodePort 32608]
        EnvoyGW -->|HTTPRoute: herms.bnhmeijer.nl| HermsUI[herms frontend:3000]
        EnvoyGW -->|HTTPRoute: login.bnhmeijer.nl| KeycloakK8s[keycloak:8080]
        EnvoyGW -->|HTTPRoute: influx.bnhmeijer.nl| InfluxK8s[influxdb:8086]
        EnvoyGW -->|HTTPRoute: thuus.bnhmeijer.nl/argocd| ArgoCDK8s[argocd-server:80]
        EnvoyGW -->|HTTPRoute: infra.bnhmeijer.nl| InfraWebK8s[infra-web:3000]
    end
```

---

## 📑 Overzicht van VHosts (`/sites/vhosts/`)

| Configuratiebestand | Domein / Hostname | Doel & Proxy Doel |
| :--- | :--- | :--- |
| [`001-main.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/001-main.conf) | `thuus.bnhmeijer.nl`, `10.2.0.4`, `vmserver.lan` (HTTP:80) | Port 80 redirect naar HTTPS + `/radio/` Icecast streaming |
| [`001-main-le-ssl.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/001-main-le-ssl.conf) | `thuus.bnhmeijer.nl` (HTTPS:443) | **Hoofdportaal**: OIDC auth (Keycloak), Nextcloud alias, Jellyfin, Icecast, *Arr stack, `/argocd` via `127.0.0.1:32608` |
| [`cloud.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/cloud.conf) & [`cloud-ssl.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/cloud-ssl.conf) | `cloud.bnhmeijer.nl` | Nextcloud DocumentRoot `/sites/nextcloud/` |
| [`git.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/git.conf) | `git.bnhmeijer.nl` | Reverse proxy naar Gitea op `127.0.0.1:3000` (512MB body limit) |
| [`hass.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/hass.conf) & [`hass-ssl.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/hass-ssl.conf) | `ha.bnhmeijer.nl` | Reverse proxy + WebSockets naar Home Assistant (`192.168.2.15:8123`) |
| [`herms.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/herms.conf) & [`herms-int.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/herms-int.conf) | `herms.bnhmeijer.nl` | Reverse proxy + WebSockets naar Envoy Gateway NodePort (`127.0.0.1:32608`) |
| [`keycloak.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/keycloak.conf) | `login.bnhmeijer.nl` | Reverse proxy naar Keycloak via Envoy Gateway NodePort (`127.0.0.1:32608`) |
| [`influx-ui.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/influx-ui.conf) | `influx-ui.bnhmeijer.nl`, `influx-ui.lan` | Reverse proxy naar InfluxDB Explorer via Envoy Gateway NodePort (`127.0.0.1:32608`) |

---

## 🔐 OpenID Connect (OIDC) Configuratie

In [`001-main-le-ssl.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/001-main-le-ssl.conf) verzorgt `mod_auth_openidc` Single Sign-On (SSO):
* **Metadata URL**: `https://login.bnhmeijer.nl/realms/master/.well-known/openid-configuration`
* **Client ID**: `apache-vmserver`
* **Redirect URI**: `https://thuus.bnhmeijer.nl/oauth2/callback`
* **Doorgegeven Headers**: Claims worden doorgestuurd als `X-User` (`%{OIDC-preferred_username}e`) en `X-Email` (`%{OIDC-email}e`). Interne OIDC headers worden gestript voordat verkeer naar backend-services gaat.

---

## ⚙️ Beheer & Herstarten op de Host

Wanneer vhosts worden aangepast op de host `vmserver`:

```bash
# Configuratie testen
sudo apache2ctl configtest

# Apache herladen zonder downtime
sudo systemctl reload apache2

# Of volledige herstart
sudo systemctl restart apache2
```