Need help with Apache Reverse Proxy reddit / selfhosted ---------------------------------------------------------------------- alphamike1612 · 2023-10-21 10:34 Hi, Like the title says, I need some help with my apache reverse proxy config. This is for r/kavita \- a self hosted book reader. My current VirtualHost config is: ServerName kavita.internal Redirect permanent / https://kavita.internal ServerName kavita.internal SSLEngine on SSLVerifyClient optional SSLOptions +FakeBasicAuth SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off AuthName "Please provide password and username to access" AuthType Basic AuthUserFile /etc/apache2/.htpasswd Require valid-user Require ip 127.0.0.1 ProxyPreserveHost On ProxyRequests Off ProxyPass / http://kavita-machine:5000/ ProxyPassReverse / http://kavita-machine:5000/ SSLCertificateFile /home/username/Documents/ssl\_certificates/certs/Kavita.crt SSLCertificateKeyFile /home/username/Documents/ssl\_certificates/keys/Kavita.key SSLCACertificateFile /home/username/Documents/ssl\_certificates/CA/HomeLabCA.crt What I expect this vhost config to do: 1. Redirect port 80 (HTTP) requests to HTTPS. 2. Request a Client Certificate when someone tries to access the domain on HTTPS. 3. If client certificate provided, then match and verify, then allow access. 4. If client certificate is not provided, then ask for login information via basic auth. 5. Allow access to website, only if the client authenticates itself or it is localhost (127.0.0.1) 6. Proxy and Reverse Proxy everything between kavita.internal and kavita-machine:5000. ​ As expected, this does everything I want it to, except it doesn't let me login. I hit the login screen, I enter my credentials and the page refreshes back to the login screen. Kavita logs show that I have been successfully authenticated. This happens on any machine other than the localhost machine that has Apache on it. My apache access.log shows 401 requests after the initial ok 200 request. 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:12:54:57 +0530] "POST /api/account/login HTTP/1.1" 200 1750 "https://kavita.internal/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 -/C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:12:54:57 +0530] "GET /api/device HTTP/1.1" 401 205 "https://kavita.internal/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:12:54:57 +0530] "GET /api/license/valid- license?forceCheck=false HTTP/1.1" 401 205 "https://kavita.internal/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:12:54:57 +0530] "GET /api/stream/dashboard?visibleOnly=true HTTP/1.1" 401 529 "https://kavita.internal/libraries" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:12:54:57 +0530] "POST /hubs/messages/negotiate?negotiateVersion=1 HTTP/1.1" 401 529 "https://kavita.internal/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:12:54:57 +0530] "GET /api/admin/exists HTTP/1.1" 200 394 "https://kavita.internal/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:12:54:57 +0530] "GET /api/stream/dashboard?visibleOnly=true HTTP/1.1" 401 205 "https://kavita.internal/libraries" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" If I remove this part of the vhost config: AuthName "Please provide password and username to access" AuthType Basic AuthUserFile /etc/apache2/.htpasswd Require valid-user Require ip 127.0.0.1 I am able to access the website as intended, from all devices. This is the same config I use for accessing other sites, such as for example r/navidrome \- a self hosted music streaming website. But in that case, I don't get 401 responses from the apache server and I am instead allowed to access the server. My Navidrome vhost config is: ServerName navidrome.internal Redirect permanent / https://navidrome.internal ServerName navidrome.internal SSLEngine on SSLVerifyClient optional SSLOptions +FakeBasicAuth SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off AuthName "Please provide password and username to access" AuthType Basic AuthUserFile /etc/apache2/.htpasswd Require valid-user Require ip 127.0.0.1 SSLCertificateFile /home/username/Documents/ssl_certificates/certs/Navidrome.crt SSLCertificateKeyFile /home/username/Documents/ssl_certificates/keys/Navidrome.key SSLCACertificateFile /home/username/Documents/ssl_certificates/CA/HomeLabCA.crt ProxyPreserveHost On ProxyRequests Off ProxyPass / http://localhost:4533/ ProxyPassReverse / http://localhost:4533/ ​ Posting a few responses: 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:30 +0530] "GET / HTTP/1.1" 302 4755 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:30 +0530] "GET /app/ HTTP/1.1" 200 1459 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/static/css/main.d3f6d208.css HTTP/1.1" 200 8732 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/static/js/main.2d778069.js HTTP/1.1" 200 484893 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/navidrome-service-worker.js HTTP/1.1" 200 1192 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/3rdparty/workbox/workbox-sw.js HTTP/1.1" 200 1213 "https://navidrome.internal/app/navidrome-service- worker.js" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/3rdparty/workbox/workbox- core.prod.js HTTP/1.1" 200 1920 "https://navidrome.internal/app/navidrome-service-worker.js" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/3rdparty/workbox/workbox- strategies.prod.js HTTP/1.1" 200 2747 "https://navidrome.internal/app/navidrome-service-worker.js" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/3rdparty/workbox/workbox- routing.prod.js HTTP/1.1" 200 1940 "https://navidrome.internal/app/navidrome-service-worker.js" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/3rdparty/workbox/workbox- navigation-preload.prod.js HTTP/1.1" 200 788 "https://navidrome.internal/app/navidrome-service-worker.js" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/manifest.webmanifest HTTP/1.1" 200 4988 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/offline.html HTTP/1.1" 200 715 "https://navidrome.internal/app/navidrome-service-worker.js" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /app/android-chrome-192x192.png HTTP/1.1" 200 10321 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:31 +0530] "GET /backgrounds HTTP/1.1" 302 590 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:41 +0530] "POST /auth/login HTTP/1.1" 200 1316 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:41 +0530] "GET /api/keepalive/keepalive HTTP/1.1" 200 831 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:41 +0530] "GET /api/transcoding?_end=1000&_order=ASC&_sort=name&_start=0 HTTP/1.1" 200 1115 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:41 +0530] "GET /api/playlist?_end=0&_sort=name&_start=-100 HTTP/1.1" 200 871 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:41 +0530] "GET /api/album?_end=18&_order=DESC&_sort=recently_added&_start=0 HTTP/1.1" 200 4571 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:41 +0530] "GET /rest/getScanStatus?u=username&t=pas sword&s=salt&f=json&v=1.8.0&c=NavidromeUI HTTP/1.1" 200 1077 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:41 +0530] "GET /rest/getCoverArt?u=username&t=passw ord&s=salt&f=json&v=1.8.0&c=NavidromeUI&id=al- 5fe43ff597f1af6e944459d70095acad&_=2023-10- 19T13%3A16%3A12.134Z&size=300 HTTP/1.1" 200 123905 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.0.101 - /C=IN/ST=ransom/L=random/O=random/emailAddress=blabla@blabla.com [21/Oct/2023:15:43:41 +0530] "GET /rest/getCoverArt?u=username&t=passw ord&s=salt&f=json&v=1.8.0&c=NavidromeUI&id=al- bcb75837eb9bbe504bfa98837b1239f7&_=2023-09-13T05%3A30%3A02Z&size=300 HTTP/1.1" 200 114173 "https://navidrome.internal/app/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" The only difference between the 2 systems is that Navidrome is hosted on the same machine that Apache is running on and Kavita is hosted on a different machine. Specs - Apache version2.4.57 Apache Server (Also running Navidrome) - Raspberry Pi 4B 8GB variant with Pi OS Bookworm Kavita Machine - HP Laptop (Core i5 6th gen) with Debian 12 Bookworm I have sanitised my logs as well as I know, if I've left something out, removed something that is required please let me know. My question is what is happening here that Kavita is getting 401 error codes, while Navidrome is not? ​ Thank you for the help ---------------------------------------------------------------------- jimboolaya · 2023-10-21 12:07 Looking at https://wiki.kavitareader.com/en/install/access-kavita- from-network/reverse-proxy/apache2-example, you're missing some stuff. ---------------------------------------------------------------------- alphamike1612 · 2023-10-21 12:37 Yes, but even with those lines in and the vhost config I first posted, I gave the same problem. In other words, adding or removing that stuff makes no meaningful difference. ---------------------------------------------------------------------- kayson · 2023-10-21 16:46 My guess is kavita is blocking your logins, not apache, because the cookies aren't being set correctly after login. Try this directive: ht tps://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypassreversecoo kiedomain ---------------------------------------------------------------------- alphamike1612 · 2023-10-21 16:49 Will read the site, thank you for sharing. But again, how does this explain apache logging 401 errors? Or with the auth section commented out, the entire thing works as expected? ---------------------------------------------------------------------- kayson · 2023-10-21 17:29 Oh then it's definitely Apache blocking you and I think you need to use a Proxy directive instead of Location.