Setting up Apache

We assume here that SSL is used for the whole SDI.
Having a mixed SSL/non-SSL setup should work, but will require several changes in your configuration.

Modules setup

sudo a2enmod proxy proxy_http ssl rewrite headers deflate
sudo systemctl restart apache2

Directory structure

sudo mkdir -p /var/www/georchestra/htdocs
sudo mkdir /var/www/georchestra/conf
sudo mkdir /var/www/georchestra/logs
sudo mkdir /var/www/georchestra/ssl

Debian apache user being www-data, we have to grant write on logs to www-data:

sudo chgrp www-data /var/www/georchestra/logs/
sudo chmod g+w /var/www/georchestra/logs/

We publish sample files for your htdocs folder in the georchestra/htdocs repository:

cd /var/www/georchestra/
sudo git clone

It is recommended to edit them to match your setup.


Let's first deactivate the default virtualhosts, and create ours:

sudo a2dissite default 000-default default-ssl

In /etc/apache2/sites-available/georchestra.conf:

<VirtualHost *:80>
    DocumentRoot /var/www/georchestra/htdocs
    LogLevel warn
    ErrorLog /var/www/georchestra/logs/error.log
    CustomLog /var/www/georchestra/logs/access.log "combined"
    Include /var/www/georchestra/conf/*.conf
    ServerSignature Off
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
<VirtualHost *:443>
    DocumentRoot /var/www/georchestra/htdocs
    LogLevel warn
    ErrorLog /var/www/georchestra/logs/error.log
    CustomLog /var/www/georchestra/logs/access.log "combined"
    Include /var/www/georchestra/conf/*.conf
    SSLEngine On
    SSLCertificateFile /var/www/georchestra/ssl/georchestra.crt
    SSLCertificateKeyFile /var/www/georchestra/ssl/georchestra-unprotected.key
    SSLCACertificateFile /etc/ssl/certs/ca-certificates.crt
    # alternate setup with letsencrypt:
    #SSLCertificateFile /etc/letsencrypt/live/
    #SSLCertificateKeyFile /etc/letsencrypt/live/
    #SSLCertificateChainFile /etc/letsencrypt/live/
    ServerSignature Off

Update your hosts files (in /etc/hosts):

Once this is done, enable the georchestra site with:

sudo a2ensite georchestra


In /var/www/georchestra/conf/, we will create several files, which will be loaded by both virtualhosts. In these files, we will make the assumption that the tomcat hosting the security proxy listens on port 8180. You may need to adapt this to your setup.

Three of these files are required:

<IfModule !mod_proxy.c>
    LoadModule proxy_module /usr/lib/apache2/modules/
<IfModule !mod_proxy_http.c>
    LoadModule proxy_http_module /usr/lib/apache2/modules/

RewriteEngine On

AddOutputFilterByType DEFLATE text/html text/plain text/xml application/xml text/css text/javascript application/javascript

ProxyRequests Off
ProxyTimeout 86400

AddType application/vnd.ogc.context+xml .wmc

ErrorDocument 502 /errors/50x.html
ErrorDocument 503 /errors/50x.html

# redirects onto the viewer by default
RewriteRule ^/$ https://%{SERVER_NAME}/mapfishapp/ [R=301,L]

ProxyPass /casfailed.jsp http://localhost:8180/casfailed.jsp
ProxyPassReverse /casfailed.jsp http://localhost:8180/casfailed.jsp

ProxyPass /login/cas http://localhost:8180/login/cas
ProxyPassReverse /login/cas http://localhost:8180/login/cas

ProxyPass /logout http://localhost:8180/logout
ProxyPassReverse /logout http://localhost:8180/logout

ProxyPass /gateway http://localhost:8180/gateway
ProxyPassReverse /gateway http://localhost:8180/gateway

ProxyPass /testPage http://localhost:8180/testPage
ProxyPassReverse /testPage http://localhost:8180/testPage

<Proxy http://localhost:8180/_static/*>
    Require all granted
ProxyPass /_static/ http://localhost:8180/_static/
ProxyPassReverse /_static/ http://localhost:8180/_static/

SetEnvIf Referer "^https://georchestra\.mydomain\.org/" mysdi
<Proxy http://localhost:8180/proxy/*>
    Require env mysdi
ProxyPass /proxy/ http://localhost:8180/proxy/
ProxyPassReverse /proxy/ http://localhost:8180/proxy/

The cas module should be accessed only through https.

<Proxy http://localhost:8180/cas/*>
    Require all granted
ProxyPass /cas/ http://localhost:8180/cas/
ProxyPassReverse /cas/ http://localhost:8180/cas/

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^/cas/?.*$
RewriteRule ^/(.*)$ https://%{SERVER_NAME}/$1 [R=301,L]

For the other ones, pick only those you need, depending on the modules you plan to install:

<Proxy http://localhost:8180/analytics/*>
    Require all granted
ProxyPass /analytics/ http://localhost:8180/analytics/
ProxyPassReverse /analytics/ http://localhost:8180/analytics/
<Proxy http://localhost:8180/extractorapp/*>
    Require all granted
ProxyPass /extractorapp/ http://localhost:8180/extractorapp/
ProxyPassReverse /extractorapp/ http://localhost:8180/extractorapp/
<Proxy http://localhost:8180/geonetwork/*>
    Require all granted
ProxyPass /geonetwork/ http://localhost:8180/geonetwork/
ProxyPassReverse /geonetwork/ http://localhost:8180/geonetwork/

Optionally, to preserve permalinks generated with a previous GeoNetwork 2.x instance:

<Location "/geonetwork">
    RewriteEngine on
    RewriteCond "%{REQUEST_URI}" "/geonetwork/apps/georchestra/"
    RewriteCond "%{QUERY_STRING}" "(.*(?:^|&))uuid=([^&]*)&?(.*)&?$"
    RewriteRule "(.*)" "/geonetwork/srv/eng/" [R=302,NE,QSD,L]
<Proxy http://localhost:8180/geoserver/*>
    Require all granted
<Location /geoserver>
  Header set Access-Control-Allow-Origin "*"
  Header set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept"
ProxyPass /geoserver/ http://localhost:8180/geoserver/
ProxyPassReverse /geoserver/ http://localhost:8180/geoserver/
<Proxy http://localhost:8180/geowebcache/*>
    Require all granted
ProxyPass /geowebcache/ http://localhost:8180/geowebcache/
ProxyPassReverse /geowebcache/ http://localhost:8180/geowebcache/
<Proxy http://localhost:8180/header/*>
    Require all granted
ProxyPass /header/ http://localhost:8180/header/
ProxyPassReverse /header/ http://localhost:8180/header/
<Proxy http://localhost:8180/console/*>
    Require all granted
ProxyPass /console/ http://localhost:8180/console/
ProxyPassReverse /console/ http://localhost:8180/console/
<Proxy http://localhost:8180/mapfishapp/*>
    Require all granted
ProxyPass /mapfishapp/ http://localhost:8180/mapfishapp/
ProxyPassReverse /mapfishapp/ http://localhost:8180/mapfishapp/

Note that mapfishapp provides the option to display local files on the map. To do this, the file is uploaded to the mapfishapp backend. The maximum size of these file can be defined in the datadir, but in certain cases, the Apache2 proxy could be more restrictive if the LimitRequestBody had been set to a lower limit. For a normal usage, you don't need to set the LimitRequestBody.

<Proxy http://localhost:8180/atlas/*>
    Require all granted
ProxyPass /atlas/ http://localhost:8180/atlas/
ProxyPassReverse /atlas/ http://localhost:8180/atlas/

SSL certificate

A SSL certificate is now absolutely required, as the security-proxy is configured to provide "secured" cookie (i.e. which are discarded by the browser if not transmitted over a https connection).

We recommend using a certificate issued by Let's Encrypt, but one may also use a self-signed certificate.