Reverse proxy not working with Checkmk

[a3093 (Gonzalo)]

Hello everyone, I hope if any colleague has done something similar he can help me.

• I have a reverse proxy server called: gobcan
• I have a checkmk 2.1 server called: compadre
• The name of the Checkmk site: mysite

I want to be able to navigate from the proxy to the checkmk using the following url:

http://gobcan/app/mon

server “gobcan” (proxy reverse)
In my proxy I have the following:

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_http_connect.so
LoadModule proxy_http_module modules/mod_proxy_http.so

<Virtual Host *>
       DocumentRoot /var/www/html
       SSLProxyEngine on
       ProxyRequests off
        ProxyPreserveHost off
        ServerName gobcan

        ProxyPass "/app/mon/" "http://compadre/mysite/"
        ProxyPassReverse "/app/mon/" "http://compadre/mysite/"
</VirtualHost>

Server “compadre” (checkmk)
and in the Checkmk I have configured:

cat mysite.conf
Include /omd/sites/mysite/etc/apache/mode.conf

Capturing the packets of compadre (checkmk) I get that:

The last packet is a 302 which should redirect to:

Location: /mysite/check_mk/login.py?_origtarget=index.py

But as observed, it stops. There is no redirection to the final route.

Does anyone know where the error is or can you share your configuration?

Thank you

[andreas-doehler (Andreas)]

Why using a second server? The system Apache on the CMK server is already acting as a reverse proxy for all running sites on this machine. You can extend the config of the system Apache with your needed “ProxyPass”.

[a3093 (Gonzalo)]

It is a Reverse Proxy common to the entire organization.
Web requests have to go through that server (gobcan).

My setup is an example of a lab. It is not the real one.

[louis (Louis Wevers)]

This works for me:

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerAdmin       support@*****
    ServerName        server@domain.com
    ProxyRequests     off
    ProxyPreserveHost On
    ProxyPass         / http://<IP of CheckMK server>:80/ retry=0 timeout=15
    ProxyPassReverse  / http://<IP of CheckMK server>:80/

    SSLCertificateFile /etc/letsencrypt/live/<sitename>/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/<sitename>/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

You can skip the SSL stuff if you don’t need it. For me that’s one of the main reasons for putting it behind the proxy.

Also, I don’t know what version of Apache you’re using, but isn’t LoadModule deprecated. I think you should use ‘a2enmod’ to enable Apache modules.

For this I have:
proxy_module
proxy_balancer_module
proxy_http_module

Or, if you’re on SUSE, like I am, enable them in /etc/sysconfig/apache2.

[a3093 (Gonzalo)]

thanks @louis

with this configuration it does work with http://gobcan/mysite

          ProxyPass "/" "http://compadre/"
          ProxyPassReverse "/" "http://compadre/"

However, I need to pass the following path to the URL: http://gobcan/app/mon

that’s why i’m using

ProxyPass "/app/mon/" "http://compadre/mysite/"
ProxyPassReverse "/app/mon/" "http://compadre/mysite/"

but it doesn’t work.

SSL I will configure it at the end.

[louis (Louis Wevers)]

I think you’ll need to do something with URL Rewrite (rewrite engine), but I’m no expert on that, sorry.

Maybe you can try something like this:

a2enmod rewrite

And then in the configuration:

RewriteEngine on
RewriteRule ^/app/mon/ /mysite [NC]

But you’ll have to play around with than. Like I said, I’m no expert on that.

Good luck,
Louis

[a3093 (Gonzalo)]

Hello @louis,

Thank you for your interest and for your help. I am not an expert either and the Apache configuration is quite complex for me.

It seems that I have found a configuration that works. I need to do more tests. I copy it here in case someone needs it in the future:

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_http_connect.so
LoadModule proxy_http_module modules/mod_proxy_http.so

<VirtualHost *>
        DocumentRoot /var/www/html
        SSLProxyEngine on
        ProxyRequests off
        ProxyPreserveHost off
        ServerName gobcan

        ProxyPass "/app/mon/" "http://compadre/mysite/"
        ProxyPassReverse "/app/mon/" "/mysite/"
        ProxyPassReverseCookiePath  "/mysite/" "/app/mon/"

</VirtualHost>