87 lines
4.8 KiB
Markdown
87 lines
4.8 KiB
Markdown
# Apache Reverse Proxy & VHosts (`10.2.0.4`)
|
|
|
|
Op host **`vmserver`** (`10.2.0.4`) draait Apache 2 direct als **Edge Reverse Proxy, TLS Terminator en OIDC Authentication Gateway** vóór zowel bare-metal hostdiensten als het Kubernetes cluster.
|
|
|
|
---
|
|
|
|
## 📂 Locatie & Synchronisatie
|
|
|
|
* **Host-pad (live configuratie)**: `/sites/vhosts/`
|
|
* **Git Repository**: [`cluster-infra/vhosts/`](file:///home/bart/git/cluster/cluster-infra/vhosts/) in `https://git.bnhmeijer.nl/bart/cluster-infra.git`
|
|
* **Certificaten (Let's Encrypt)**: `/etc/letsencrypt/live/thuus.bnhmeijer.nl/`
|
|
* **Certbot challenge root**: `/sites/certroot/.well-known`
|
|
|
|
---
|
|
|
|
## 🏗️ Architectuur: Apache als Edge Gateway
|
|
|
|
```mermaid
|
|
flowchart TD
|
|
Client[Inkomend Verkeer / Browser] -->|Poort 80 / 443| Apache["Apache 2 (10.2.0.4)<br>/sites/vhosts/"]
|
|
|
|
subgraph Apache Functionaliteit
|
|
Apache -->|TLS / Let's Encrypt| SSL[SSL Termination]
|
|
Apache -->|mod_auth_openidc| OIDC[OIDC Auth via login.bnhmeijer.nl]
|
|
end
|
|
|
|
subgraph Bare-Metal Host Services
|
|
Apache -->|Proxy :3000| Gitea[Gitea git.bnhmeijer.nl]
|
|
Apache -->|Proxy :8096| Jellyfin[Jellyfin /jellyfin]
|
|
Apache -->|Proxy :8000 / :5000| Radio[Icecast & Radio Chicken]
|
|
Apache -->|Proxy :8686, :7878, ...| ArrStack["*Arr Stack (Sonarr, Radarr, etc.)"]
|
|
Apache -->|DocRoot /sites/nextcloud| Nextcloud[cloud.bnhmeijer.nl]
|
|
Apache -->|Proxy 192.168.2.15:8123| HomeAssistant[ha.bnhmeijer.nl]
|
|
end
|
|
|
|
subgraph Kubernetes Cluster (vmserver:10.2.0.4)
|
|
Apache -->|Proxy 127.0.0.1:32608<br>(Envoy Gateway NodePort)| EnvoyGW[Envoy Gateway NodePort 32608]
|
|
EnvoyGW -->|HTTPRoute: herms.bnhmeijer.nl| HermsUI[herms frontend:3000]
|
|
EnvoyGW -->|HTTPRoute: login.bnhmeijer.nl| KeycloakK8s[keycloak:8080]
|
|
EnvoyGW -->|HTTPRoute: influx.bnhmeijer.nl| InfluxK8s[influxdb:8086]
|
|
EnvoyGW -->|HTTPRoute: thuus.bnhmeijer.nl/argocd| ArgoCDK8s[argocd-server:80]
|
|
EnvoyGW -->|HTTPRoute: infra.bnhmeijer.nl| InfraWebK8s[infra-web:3000]
|
|
end
|
|
```
|
|
|
|
---
|
|
|
|
## 📑 Overzicht van VHosts (`/sites/vhosts/`)
|
|
|
|
| Configuratiebestand | Domein / Hostname | Doel & Proxy Doel |
|
|
| :--- | :--- | :--- |
|
|
| [`001-main.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/001-main.conf) | `thuus.bnhmeijer.nl`, `10.2.0.4`, `vmserver.lan` (HTTP:80) | Port 80 redirect naar HTTPS + `/radio/` Icecast streaming |
|
|
| [`001-main-le-ssl.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/001-main-le-ssl.conf) | `thuus.bnhmeijer.nl` (HTTPS:443) | **Hoofdportaal**: OIDC auth (Keycloak), Nextcloud alias, Jellyfin, Icecast, *Arr stack, `/argocd` via `127.0.0.1:32608` |
|
|
| [`cloud.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/cloud.conf) & [`cloud-ssl.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/cloud-ssl.conf) | `cloud.bnhmeijer.nl` | Nextcloud DocumentRoot `/sites/nextcloud/` |
|
|
| [`git.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/git.conf) | `git.bnhmeijer.nl` | Reverse proxy naar Gitea op `127.0.0.1:3000` (512MB body limit) |
|
|
| [`hass.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/hass.conf) & [`hass-ssl.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/hass-ssl.conf) | `ha.bnhmeijer.nl` | Reverse proxy + WebSockets naar Home Assistant (`192.168.2.15:8123`) |
|
|
| [`herms.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/herms.conf) & [`herms-int.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/herms-int.conf) | `herms.bnhmeijer.nl` | Reverse proxy + WebSockets naar Envoy Gateway NodePort (`127.0.0.1:32608`) |
|
|
| [`keycloak.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/keycloak.conf) | `login.bnhmeijer.nl` | Reverse proxy naar Keycloak via Envoy Gateway NodePort (`127.0.0.1:32608`) |
|
|
| [`influx-ui.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/influx-ui.conf) | `influx-ui.bnhmeijer.nl`, `influx-ui.lan` | Reverse proxy naar InfluxDB Explorer via Envoy Gateway NodePort (`127.0.0.1:32608`) |
|
|
|
|
---
|
|
|
|
## 🔐 OpenID Connect (OIDC) Configuratie
|
|
|
|
In [`001-main-le-ssl.conf`](file:///home/bart/git/cluster/cluster-infra/vhosts/001-main-le-ssl.conf) verzorgt `mod_auth_openidc` Single Sign-On (SSO):
|
|
* **Metadata URL**: `https://login.bnhmeijer.nl/realms/master/.well-known/openid-configuration`
|
|
* **Client ID**: `apache-vmserver`
|
|
* **Redirect URI**: `https://thuus.bnhmeijer.nl/oauth2/callback`
|
|
* **Doorgegeven Headers**: Claims worden doorgestuurd als `X-User` (`%{OIDC-preferred_username}e`) en `X-Email` (`%{OIDC-email}e`). Interne OIDC headers worden gestript voordat verkeer naar backend-services gaat.
|
|
|
|
---
|
|
|
|
## ⚙️ Beheer & Herstarten op de Host
|
|
|
|
Wanneer vhosts worden aangepast op de host `vmserver`:
|
|
|
|
```bash
|
|
# Configuratie testen
|
|
sudo apache2ctl configtest
|
|
|
|
# Apache herladen zonder downtime
|
|
sudo systemctl reload apache2
|
|
|
|
# Of volledige herstart
|
|
sudo systemctl restart apache2
|
|
```
|