Configuring Apache HTTP Reverse-Proxy

Exposing OpenKM directly from Tomcat can be risky if you need the application to be accessed from the Internet (for example https://issues.jboss.org/browse/JBAS-3861). It could be infected by PerlBot. 8080 may be blocked by a firewall; for this reason, it is recommended to expose your OpenKM installation through the standard web port 80. In the following steps we explain how to configure Apache to handle these requests and forward them to the Tomcat application server using the AJP13 protocol.

From the Apache documentation: The AJP13 protocol is packet-oriented. A binary format was presumably chosen over the more readable plain text for performance reasons. The web server communicates with the servlet container over TCP connections. To cut down on the expensive process of socket creation, the web server will attempt to maintain persistent TCP connections to the servlet container, and to reuse a connection for multiple request/response cycles.

Internal IP vs external IP

Your OpenKM can be accessed from two different zones: Internet and LAN. This means that to access this server you need to use two IP addresses: an external IP (Internet) and an internal IP (LAN).

The internal IP address (also known as "local IP address") is the address assigned by your local network router and often begins with 192.168.x.x. These IP addresses can only be seen by other computers in your local network (LAN) and not by any computers connected in an external network such as the Internet.

To reach the Internet or a computer in another network your computer is often assigned an external IP address, which can then be used to refer to the computer in your local network.

In the above picture, there are three computers in the local network that have each been assigned their own internal IP address by the router. The ISP is connected to the router and gives the router an external IP address that allows it to communicate with the Internet. On the Internet everyone sees your external IP address, but any information coming from the router is "converted" from the external IP address to the internal IP address.

So if you want your OpenKM installation to be accessible from both LAN and Internet, the trick here is to configure the client computers to resolve your internal IP (192.168.0.50) if they are inside the LAN or the external IP if they are on the Internet. To resolve the Internet IP (67.166.214.148), your computer uses the public DNS. So, you need to configure a sort of DNS server inside the LAN or modify every client hosts file to resolve to the internal IP.

Debian and Ubuntu

The first thing is to install the required Apache software. On Debian/Ubuntu, you can install Apache with a single command:

Edit the file named /etc/apache2/apache2.conf and configure a ServerName to prevent warnings in the Apache startup process:

ServerRoot "/etc/apache2"
ServerName "your-domain.com"

Enable the proxy module:

 Create the configuration file /etc/apache2/sites-available/openkm.conf with this content:  

<VirtualHost *:80>
  ServerName openkm.your-domain.com
  RedirectMatch ^/$ /openkm

  # WebSocket support - needs proxy-wstunnel
  ProxyPass /openkm/frontend/webSocket ws://127.0.0.1:8080/openkm/frontend/webSocket
  ProxyPassReverse /openkm/frontend/webSocket ws://127.0.0.1:8080/openkm/frontend/webSocket

  ProxyPass /openkm ajp://127.0.0.1:8009/openkm keepalive=On
  ProxyPassReverse /openkm http://openkm.your-domain.com/openkm

  ErrorLog /var/log/apache2/openkm-error.log
  CustomLog /var/log/apache2/openkm-access.log combined
</VirtualHost>

The VirtualHost ServerName must be different from the ServerName in the main Apache configuration. Enable this site configuration:

You have to explicitly enable proxy access by editing the Apache configuration file /etc/apache2/mods-available/proxy.conf:

<IfModule mod_proxy.c>
  #turning ProxyRequests on and allowing proxying from all may allow
  #spammers to use your proxy to send email.
 
  ProxyRequests Off
 
  <Proxy *>
    AddDefaultCharset off
    Order deny,allow
    Allow from all
    Deny from all
    #Allow from .example.com
  </Proxy>
 
  # Enable/disable the handling of HTTP/1.1 "Via:" headers.
  # ("Full" adds the server version; "Block" removes all outgoing Via: headers)
  # Set to one of: Off | On | Full | Block
 
  ProxyVia On
</IfModule>

Check the configuration

Restart Apache:

Check access to your OpenKM installation at http://openkm.your-domain.com/.  

Red Hat and CentOS

Use the yum application manager to install Apache:

Enable it at boot:

Now create the file /etc/httpd/conf.d/openkm.conf with this content:

<VirtualHost *:80>
  ServerName openkm.your-domain.com
  RedirectMatch ^/$ /openkm

  # WebSocket support
  ProxyPass /openkm/frontend/webSocket ws://127.0.0.1:8080/openkm/frontend/webSocket
  ProxyPassReverse /openkm/frontend/webSocket ws://127.0.0.1:8080/openkm/frontend/webSocket

  ProxyPass /openkm ajp://127.0.0.1:8009/openkm keepalive=On
  ProxyPassReverse /openkm http://openkm.your-domain.com/openkm

  ErrorLog /var/log/httpd/openkm-error.log
  CustomLog /var/log/httpd/openkm-access.log combined
</VirtualHost>

Check the configuration

Restart Apache:

If this command fails, try with:

Check access to your OpenKM installation at http://openkm.your-domain.com/.  

Error Permission denied: proxy: AJP: attempt to connect

If an error like Permission denied: proxy: AJP: attempt to connect appears in the log, solve it by executing the following command:

If it works, then make the configuration permanent to persist across reboots:

Windows

The Apache web server is already included in the "extras" folder.

Edit the C:\tomcat\extras\Apache\conf\httpd.conf configuration file and uncomment the VirtualHost section at the bottom. Modify the ServerName to match your server name or IP:

<VirtualHost *:80>
 ServerName 192.168.10.230

 ProxyPass /openkm ajp://localhost:8009/openkm
 ProxyPassReverse /openkm http://192.168.10.230/openkm

 ErrorLog logs/openkm-error.log
 CustomLog logs/openkm-access.log combined
</VirtualHost>

Register Apache service

Apache SSL configuration

Set OpenSSL configuration location:

Execute this command to generate the self-certificate:

This is a sample output:

Uncomment this configuration section:

Change the default server name in conf/extras/httpd-ssl.conf to match your domain or IP:

Troubleshooting

If you see an error message like:

You need to enable these Apache modules:  

If you see errors like these:

It is possible that Tomcat is not accepting AJP connections. Please uncomment these lines in $TOMCAT_HOME/conf/server.xml:

<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector protocol="AJP/1.3"
           address="127.0.0.1"
           port="8009"
           redirectPort="8443"
           secretRequired="false" />

The secretRequired parameter is important, and if it's not present you need to add it.

More info at Apache Tomcat 8 Configuration Reference.

Additional information 

• Apache Module mod_proxy
• Apache Module mod_proxy_ajp
• Apache Module mod_rewrite
• mod_rewrite, a beginner’s guide
• Using Apache Virtual Hosts and ProxyPass Together