Owncast installation issue
Posted
#925
(In Topic #411)
Nerd Club Member
added website on apache proxy server
Thank you for the excellent wiki and video. I followed it and the Apache Virtual Host video verbatim and got a site up and running very quickly. I'm attempting to host another website via the same apache reverse proxy and with the addition of the new site's .conf file (and running a2ensite, reloading and running certbot) pointing a browser at the new site still brings up the owncast site.<VirtualHost *:80>
ServerName stream.example.wtf
ServerAdmin admin@example.wtf
DocumentRoot /var/www/stream
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =stream.example.wtf
RewriteRule ^ https://%$2{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
The issue would seem to be in the owncast-le-ssl.conf file. ProxyPass directives seem to redirect the stream.example requests to port 8080 also. If I comment out the ProxyPass lines the stream webpage loads, but of course the owncast page doesn't.
Also the a2ensite and a2dissite commands seem to have no effect on either site after having enabled the stream website. I've tried reinstalling the stream .conf file as 0stream to move it above owncast, to no avail. I'm a bit over my head here and would appreciate any suggestions.
Posted
NOTS Staff
It sounds like you should have four virtual host configuration files:
- Owncast port 80 (redirects to port 443)
- Owncast port 443 (includes the WebSocket forwarding to port 8080)
- Your frontend webpage port 80 (redirects to port 443)
- Your frontend webpage port 443
Both the ServerName and DocumentRoot should be different between the Owncast files and the frontend webpage files. Looking at my instructions for Owncast, you shouldn't need to modify the Owncast configuration files to add another virtual host. Can you post all four of the configuration files, labeled a bit more clearly? None of the RewriteCond lines should need a server name typed out like you have it, so I'm confused why that's there, as well as why it's different from the ServerName line.
All that the a2ensite/a2dissite commands do is create symlinks from /etc/apache2/sites-enabled/ to /etc/apache2/sites-available/ (with sites-enabled being read on Apache reload)– I cover this in the video I linked above.
Posted
NOTS Staff
The rest of my prior message still applies. Let me know if that video helps and/or if you can give me a bit more information about your complete configuration.
Posted
NOTS Staff
If you've already watched the video, then the complete configuration (all vhost files) is all that's left to advance the topic. You're welcome to keep your actual domains in if it makes things easier (I don't consider that spam), although you can change them to example domains if you'd like, as long as you do it consistently.
Posted
Nerd Club Member
I realize your time is valuable and I really appreciate your attention. I suspect this problem is reproducible and probably a conditional that needs attention. I'm just not there yet.
I hope I'm missing something obvious. Here are the current directories and virtual host files…
root@owncast:/etc/apache2/sites-available# ls -la
total 36
drwxr-xr-x 2 root root 4096 Nov 15 00:20 .
drwxr-xr-x 8 root root 4096 Nov 15 00:20 ..
-rw-r–r– 1 root root 1286 Jul 7 09:26 000-default.conf
-rw-r–r– 1 root root 336 Nov 15 00:14 0stream.conf
-rw-r–r– 1 root root 6195 Jul 18 01:26 default-ssl.conf
-rw-r–r– 1 root root 302 Sep 21 13:54 owncast.conf
-rw-r–r– 1 root root 933 Nov 15 00:20 owncast-le-ssl.conf
-rw-r–r– 1 root root 426 Nov 15 00:20 stream-le-ssl.conf
root@owncast:~# ls -la /etc/apache2/sites-enabled
total 8
drwxr-xr-x 2 root root 4096 Nov 15 00:47 .
drwxr-xr-x 8 root root 4096 Nov 15 00:47 ..
lrwxrwxrwx 1 root root 35 Sep 21 02:24 000-default.conf -> ../sites-available/000-default.conf
lrwxrwxrwx 1 root root 31 Nov 15 00:46 0stream.conf -> ../sites-available/0stream.conf
lrwxrwxrwx 1 root root 48 Nov 15 00:47 0stream-le-ssl.conf -> /etc/apache2/sites-available/0stream-le-ssl.conf
lrwxrwxrwx 1 root root 31 Nov 14 23:16 owncast.conf -> ../sites-available/owncast.conf
lrwxrwxrwx 1 root root 38 Nov 14 23:17 owncast-le-ssl.conf -> ../sites-available/owncast-le-ssl.conf
GNU nano 7.2 000-default.conf
<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
#ServerName www.example.com
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
# Available loglevels: trace8, …, trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
</VirtualHost>
GNU nano 7.2 0stream.conf
<VirtualHost *:80>
ServerName stream.seth.wtf
ServerAdmin seth@seth.wtf
DocumentRoot /var/www/stream
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =stream.seth.wtf
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
GNU nano 7.2 owncast.conf
<VirtualHost *:80>
ServerName live.seth.wtf
ServerAdmin seth@seth.wtf
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =live.seth.wtf
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
GNU nano 7.2 owncast-le-ssl.conf
<IfModule mod_ssl.c> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<←—— [i][b]I think this is the issue[/b][/i]
<VirtualHost *:443>
ServerName live.seth.wtf
ServerAdmin seth@seth.wtf
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/live.seth.wtf/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/live.seth.wtf/privkey.pem
</VirtualHost>
</IfModule>
# Proxy traffic to/from Owncast.
ProxyRequests Off
ProxyPreserveHost On
AllowEncodedSlashes NoDecode
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
# Ensure websocket connections are also proxied.
RewriteEngine On
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:8080%{REQUEST_URI} [P,QSA,L]
GNU nano 7.2 stream-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName stream.seth.wtf
ServerAdmin seth@seth.wtf
DocumentRoot /var/www/stream
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/live.seth.wtf/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/live.seth.wtf/privkey.pem
</VirtualHost>
</IfModule>
GNU nano 7.2 default-ssl.conf
<VirtualHost *:443>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
# Available loglevels: trace8, …, trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# A self-signed (snakeoil) certificate can be created by installing
# the ssl-cert package. See
# /usr/share/doc/apache2/README.Debian.gz for more info.
# If both key and certificate are stored in the same file, only the
# SSLCertificateFile directive is needed.
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all
# of them (file must be PEM encoded)
# Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(?:cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
# BrowserMatch "MSIE [2-6]" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
</VirtualHost>
Posted
NOTS Staff
I think I've spotted what you did wrong. This is your current owncast-le-ssl.conf file:
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName live.seth.wtf
ServerAdmin seth@seth.wtf
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/live.seth.wtf/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/live.seth.wtf/privkey.pem
</VirtualHost>
</IfModule>
# Proxy traffic to/from Owncast.
ProxyRequests Off
ProxyPreserveHost On
AllowEncodedSlashes NoDecode
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
# Ensure websocket connections are also proxied.
RewriteEngine On
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:8080%{REQUEST_URI} [P,QSA,L]
You've correctly identified that all traffic is being redirected (or, rather, proxied) to port 8080. The reason is because you put that configuration after the closing </VirtualHost> tag, which means it's just general configuration you've applied to your server (any files before it are applied first, hence why the HTTP to HTTPS redirects are working, but the configuration is still being applied).
The "additional configuration" from Step 9 of my guide is supposed to go inside of the <VirtualHost> … </VirtualHost> block. That will restrict the configuration to only traffic destined for that virtual host. You can see where I inserted it at this timestamp of my video– I actually put it before the SSL certificate lines, although off the top of my head, I think putting it after those lines would behave the same, as long as it's inside of the VirtualHost block.
Let me know if that helps!
Posted
Nerd Club Member
Posted
NOTS Staff
1 guest and 0 members have just viewed this.