Setting up Apache

We assume here that SSL is used for the whole SDI.
Having a mixed SSL/non-SSL setup should work, but will require several changes in your configuration.

Modules setup

sudo a2enmod proxy proxy_http ssl rewrite headers deflate
sudo service apache2 restart

Directory structure

sudo mkdir -p /var/www/georchestra/htdocs
sudo mkdir /var/www/georchestra/conf 
sudo mkdir /var/www/georchestra/logs 
sudo mkdir /var/www/georchestra/ssl

Debian apache user being www-data, we have to grant write on logs to www-data:

sudo chgrp www-data /var/www/georchestra/logs/
sudo chmod g+w /var/www/georchestra/logs/

We publish sample files for your htdocs folder in the georchestra/htdocs repository:

cd /var/www/georchestra/
sudo git clone https://github.com/georchestra/htdocs.git

It is recommended to edit them to match your setup.

VirtualHosts

Let's first deactivate the default virtualhosts, and create ours:

sudo a2dissite default 000-default default-ssl

In /etc/apache2/sites-available/georchestra.conf:

<VirtualHost *:80>
    ServerName georchestra.mydomain.org
    DocumentRoot /var/www/georchestra/htdocs
    LogLevel warn
    ErrorLog /var/www/georchestra/logs/error.log
    CustomLog /var/www/georchestra/logs/access.log "combined"
    Include /var/www/georchestra/conf/*.conf
    ServerSignature Off
    RewriteCond %{HTTPS} off 
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} 
</VirtualHost>
<VirtualHost *:443>
    ServerName georchestra.mydomain.org
    DocumentRoot /var/www/georchestra/htdocs
    LogLevel warn
    ErrorLog /var/www/georchestra/logs/error.log
    CustomLog /var/www/georchestra/logs/access.log "combined"
    Include /var/www/georchestra/conf/*.conf
    SSLEngine On
    SSLCertificateFile /var/www/georchestra/ssl/georchestra.crt
    SSLCertificateKeyFile /var/www/georchestra/ssl/georchestra-unprotected.key
    SSLCACertificateFile /etc/ssl/certs/ca-certificates.crt
    # alternate setup with letsencrypt:
    #SSLCertificateFile /etc/letsencrypt/live/mysdi.org/cert.pem
    #SSLCertificateKeyFile /etc/letsencrypt/live/mysdi.org/privkey.pem
    #SSLCertificateChainFile /etc/letsencrypt/live/mysdi.org/fullchain.pem
    ServerSignature Off
</VirtualHost>

Update your hosts files (in /etc/hosts):

127.0.0.1       georchestra.mydomain.org

Once this is done, enable the georchestra site with:

sudo a2ensite georchestra

Configuration

In /var/www/georchestra/conf/, we will create several files, which will be loaded by both virtualhosts. In these files, we will make the assumption that the tomcat hosting the security proxy listens on port 8180. You may need to adapt this to your setup.

Three of these files are required:

<IfModule !mod_proxy.c>
    LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so
</IfModule>
<IfModule !mod_proxy_http.c>
    LoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.so
</IfModule>

RewriteEngine On

AddOutputFilterByType DEFLATE text/html text/plain text/xml application/xml text/css text/javascript application/javascript

ProxyRequests Off
ProxyTimeout 86400

AddType application/vnd.ogc.context+xml .wmc

ErrorDocument 502 /errors/50x.html
ErrorDocument 503 /errors/50x.html
ProxyPass /casfailed.jsp http://localhost:8180/casfailed.jsp
ProxyPassReverse /casfailed.jsp http://localhost:8180/casfailed.jsp

ProxyPass /login/cas http://localhost:8180/login/cas 
ProxyPassReverse /login/cas http://localhost:8180/login/cas

ProxyPass /logout http://localhost:8180/logout 
ProxyPassReverse /logout http://localhost:8180/logout

ProxyPass /gateway http://localhost:8180/gateway
ProxyPassReverse /gateway http://localhost:8180/gateway

ProxyPass /testPage http://localhost:8180/testPage
ProxyPassReverse /testPage http://localhost:8180/testPage

<Proxy http://localhost:8180/_static/*>
    Require all granted
</Proxy>
ProxyPass /_static/ http://localhost:8180/_static/
ProxyPassReverse /_static/ http://localhost:8180/_static/

SetEnvIf Referer "^https://my\.sdi\.org/" mysdi
<Proxy http://localhost:8180/proxy/*>
    Require env mysdi
</Proxy>
ProxyPass /proxy/ http://localhost:8180/proxy/ 
ProxyPassReverse /proxy/ http://localhost:8180/proxy/

The cas module should be accessed only through https.


<Proxy http://localhost:8180/cas/*>
    Require all granted
</Proxy>
ProxyPass /cas/ http://localhost:8180/cas/ 
ProxyPassReverse /cas/ http://localhost:8180/cas/

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^/cas/?.*$ 
RewriteRule ^/(.*)$ https://%{SERVER_NAME}/$1 [R=301,L]

For the other ones, pick only those you need, depending on the modules you plan to install:

<Proxy http://localhost:8180/analytics/*>
    Require all granted
</Proxy>
ProxyPass /analytics/ http://localhost:8180/analytics/ 
ProxyPassReverse /analytics/ http://localhost:8180/analytics/
<Proxy http://localhost:8180/extractorapp/*>
    Require all granted
</Proxy>
ProxyPass /extractorapp/ http://localhost:8180/extractorapp/ 
ProxyPassReverse /extractorapp/ http://localhost:8180/extractorapp/
<Proxy http://localhost:8180/geonetwork/*>
    Require all granted
</Proxy>
ProxyPass /geonetwork/ http://localhost:8180/geonetwork/ 
ProxyPassReverse /geonetwork/ http://localhost:8180/geonetwork/
<Proxy http://localhost:8180/geoserver/*>
    Require all granted
</Proxy>
<Location /geoserver>
  Header set Access-Control-Allow-Origin "*"
  Header set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept"
</Location>
ProxyPass /geoserver/ http://localhost:8180/geoserver/ 
ProxyPassReverse /geoserver/ http://localhost:8180/geoserver/
<Proxy http://localhost:8180/geofence/*>
    Require all granted
</Proxy>
ProxyPass /geofence/ http://localhost:8180/geofence/ 
ProxyPassReverse /geofence/ http://localhost:8180/geofence/
<Proxy http://localhost:8180/geowebcache/*>
    Require all granted
</Proxy>
ProxyPass /geowebcache/ http://localhost:8180/geowebcache/ 
ProxyPassReverse /geowebcache/ http://localhost:8180/geowebcache/
<Proxy http://localhost:8180/header/*>
    Require all granted
</Proxy>
ProxyPass /header/ http://localhost:8180/header/
ProxyPassReverse /header/ http://localhost:8180/header/

<Proxy http://localhost:8180/console/*>
    Require all granted
</Proxy>
ProxyPass /console/ http://localhost:8180/console/
ProxyPassReverse /console/ http://localhost:8180/console/

RewriteCond %{REQUEST_URI} !^/console/manager/public/.*$
RewriteCond %{REQUEST_URI} ^/console/manager/([home|users|org|orgs|role|roles|logs|analytics|delegations].*)$
RewriteRule .* /console/manager/#/%1 [NE,R,L]
<Proxy http://localhost:8180/mapfishapp/*>
    Require all granted
</Proxy>
ProxyPass /mapfishapp/ http://localhost:8180/mapfishapp/ 
ProxyPassReverse /mapfishapp/ http://localhost:8180/mapfishapp/

Note that mapfishapp provides the option to display local files on the map. To do this, the file is uploaded to the mapfishapp backend. The maximum size of these file can be defined in the datadir, but in certain cases, the Apache2 proxy could be more restrictive if the LimitRequestBody had been set to a lower limit. For a normal usage, you don't need to set the LimitRequestBody.

SSL certificate

An SSL certificate is absolutely required, at least for the CAS module. We recommend using a certificate issued by Let's Encrypt, but one may also use a self-signed certificate.