Owncast installation issue

Forum home -> Tech Talk -> View topic

Post

Posted
Rating:
#925 (In Topic #411)
Avatar
Standard member

added website on apache proxy server

Thank you for the excellent wiki and video. I followed it and the Apache Virtual Host video verbatim and got a site up and running very quickly. I'm attempting to host another website via the same apache reverse proxy and with the addition of the new site's .conf file (and running a2ensite, reloading and running certbot) pointing a browser at the new site still brings up the owncast site.

<VirtualHost *:80>
ServerName stream.example.wtf
ServerAdmin admin@example.wtf

DocumentRoot /var/www/stream

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =stream.example.wtf
RewriteRule ^ https://%$2{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

The issue would seem to be in the owncast-le-ssl.conf file. ProxyPass directives seem to redirect the stream.example requests to port 8080 also. If I comment out the ProxyPass lines the stream webpage loads, but of course the owncast page doesn't.

Also the a2ensite and a2dissite commands seem to have no effect on either site after having enabled the stream website. I've tried reinstalling the stream .conf file as 0stream to move it above owncast, to no avail. I'm a bit over my head here and would appreciate any suggestions.
Online now: No Back to the top

Post

Posted
Rating:
#927
Avatar
NOTS Staff
Hello! I can't quite tell what your configuration is based on your descriptions, but it sounds an Apache configuration error. I'd recommend taking a look at my video about Apache virtual hosts to get a solid grasp of how the configuration works: https://nerdonthestreet.com/episode/tech/apache-virtual-hosts

It sounds like you should have four virtual host configuration files:
- Owncast port 80 (redirects to port 443)
- Owncast port 443 (includes the WebSocket forwarding to port 8080)
- Your frontend webpage port 80 (redirects to port 443)
- Your frontend webpage port 443

Both the ServerName and DocumentRoot should be different between the Owncast files and the frontend webpage files. Looking at my instructions for Owncast, you shouldn't need to modify the Owncast configuration files to add another virtual host. Can you post all four of the configuration files, labeled a bit more clearly? None of the RewriteCond lines should need a server name typed out like you have it, so I'm confused why that's there, as well as why it's different from the ServerName line.

All that the a2ensite/a2dissite commands do is create symlinks from /etc/apache2/sites-enabled/ to /etc/apache2/sites-available/ (with sites-enabled being read on Apache reload)– I cover this in the video I linked above.
Online now: Yes Back to the top

Post

Posted
Rating:
#928
Avatar
NOTS Staff
Oh, I see that you reported your own post last night stating the RewriteCond line having a different URL than the ServerName line was a mistake. I assume you did that because the Edit button was broken (apologies for that– I've fixed it now, and applied the edit to your original post as you requested so those two lines match).

The rest of my prior message still applies. Let me know if that video helps and/or if you can give me a bit more information about your complete configuration.
Online now: Yes Back to the top

Post

Posted
Rating:
#929
Avatar
NOTS Staff
I do also see now that you started off by saying you followed the virtual hosts video I linked you to… it's quite late here; perhaps I shouldn't reply to forum posts when I'm this tired. Anyway, it must not have been "verbatim" since it's not working (and you may not have paid close enough attention since you referred to the a2ensite/a2dissite commands as "having no effect" when I explained exactly what they do in that video).

If you've already watched the video, then the complete configuration (all vhost files) is all that's left to advance the topic. You're welcome to keep your actual domains in if it makes things easier (I don't consider that spam), although you can change them to example domains if you'd like, as long as you do it consistently.
Online now: Yes Back to the top

Post

Posted
Rating:
#930
Avatar
Standard member
Thank you for your quick response. For clarification the URL I have directed to the owncast app is live.seth.wtf. the second URL I'm attempting to include in this proxy server is stream.seth.wtf. Addressing the a2dissite - Thanks to your video I understand that the a2ensite and a2dissite commands just create and remove the symbolic links in the sites-enabled directory. I have found that only by disabling the owncast-le-ssl.conf link does the server direct my browser to the stream.seth.wtf root directory. Disabling the owncast.conf file still redirects stream.seth.wtf to the owncast site(live.seth.wtf) although it still says https://stream.seth.wtf in the browser address. Yes, I've reloaded apache2, emptied and  my browser cache after each change. I've now added a new stream virtual host file.  0stream, disabled and removed the original stream hostfiles and their associated ie-ssl files, rerun certbot, reloaded apache2, and reemptied the browser cache and pointing my browser to HTTP://stream.seth.wtf still redirects to port 8080 yet stream.seth.wtf is in the title bar. I assume *:80 virtual hosts redirect to the *:443 virtual hosts then the owncast-le-ssl.conf file is redirecting all SSL requests to port 8080.

I realize your time is valuable and I really appreciate your attention. I suspect this problem is reproducible and probably a conditional that needs attention. I'm just not there yet.

I hope I'm missing something obvious. Here are the current directories and virtual host files…

root@owncast:/etc/apache2/sites-available# ls -la
total 36
drwxr-xr-x 2 root root 4096 Nov 15 00:20 .
drwxr-xr-x 8 root root 4096 Nov 15 00:20 ..
-rw-r–r– 1 root root 1286 Jul  7 09:26 000-default.conf
-rw-r–r– 1 root root  336 Nov 15 00:14 0stream.conf
-rw-r–r– 1 root root 6195 Jul 18 01:26 default-ssl.conf
-rw-r–r– 1 root root  302 Sep 21 13:54 owncast.conf
-rw-r–r– 1 root root  933 Nov 15 00:20 owncast-le-ssl.conf
-rw-r–r– 1 root root  426 Nov 15 00:20 stream-le-ssl.conf

root@owncast:~# ls -la /etc/apache2/sites-enabled
total 8
drwxr-xr-x 2 root root 4096 Nov 15 00:47 .
drwxr-xr-x 8 root root 4096 Nov 15 00:47 ..
lrwxrwxrwx 1 root root   35 Sep 21 02:24 000-default.conf -> &#46;&#46;/sites-available/000-default.conf
lrwxrwxrwx 1 root root   31 Nov 15 00:46 0stream.conf -> &#46;&#46;/sites-available/0stream.conf
lrwxrwxrwx 1 root root   48 Nov 15 00:47 0stream-le-ssl.conf -> /etc/apache2/sites-available/0stream-le-ssl.conf
lrwxrwxrwx 1 root root   31 Nov 14 23:16 owncast.conf -> &#46;&#46;/sites-available/owncast.conf
lrwxrwxrwx 1 root root   38 Nov 14 23:17 owncast-le-ssl.conf -> &#46;&#46;/sites-available/owncast-le-ssl.conf

  GNU nano 7.2                                        000-default.conf
<VirtualHost *:80>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request&#39;s Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html

        # Available loglevels: trace8, …, trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
</VirtualHost>




  GNU nano 7.2                                          0stream.conf
<VirtualHost *:80>
ServerName stream.seth.wtf
ServerAdmin seth@seth.wtf

DocumentRoot /var/www/stream

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =stream.seth.wtf
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>



  GNU nano 7.2                                          owncast.conf
<VirtualHost *:80>
ServerName live.seth.wtf
ServerAdmin seth@seth.wtf

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =live.seth.wtf
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>


  GNU nano 7.2                                       owncast-le-ssl.conf
<IfModule mod_ssl.c>  <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<←—— [i][b]I think this is the issue[/b][/i]
<VirtualHost *:443>
ServerName live.seth.wtf
ServerAdmin seth@seth.wtf

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/live.seth.wtf/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/live.seth.wtf/privkey.pem
</VirtualHost>
</IfModule>

# Proxy traffic to/from Owncast.
ProxyRequests Off
ProxyPreserveHost On
AllowEncodedSlashes NoDecode

<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
RequestHeader set X-Forwarded-Proto &quot;https&quot;
RequestHeader set X-Forwarded-Port &quot;443&quot;

# Ensure websocket connections are also proxied.
RewriteEngine On
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:8080%{REQUEST_URI} [P,QSA,L]


  GNU nano 7.2                                       stream-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName stream.seth.wtf
ServerAdmin seth@seth.wtf

DocumentRoot /var/www/stream

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/live.seth.wtf/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/live.seth.wtf/privkey.pem
</VirtualHost>
</IfModule>

 GNU nano 7.2                                        default-ssl.conf
<VirtualHost *:443>
        ServerAdmin webmaster@localhost

        DocumentRoot /var/www/html

        # Available loglevels: trace8, …, trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with &quot;a2disconf&quot;.
        #Include conf-available/serve-cgi-bin.conf

        #   SSL Engine Switch:
        #   Enable/Disable SSL for this virtual host.
        SSLEngine on

        #   A self-signed (snakeoil) certificate can be created by installing
        #   the ssl-cert package. See
        #   /usr/share/doc/apache2/README.Debian.gz for more info.
        #   If both key and certificate are stored in the same file, only the
        #   SSLCertificateFile directive is needed.
        SSLCertificateFile      /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile   /etc/ssl/private/ssl-cert-snakeoil.key

        #   Server Certificate Chain:
        #   Point SSLCertificateChainFile at a file containing the
        #   concatenation of PEM encoded CA certificates which form the
        #   certificate chain for the server certificate. Alternatively
        #   the referenced file can be the same as SSLCertificateFile
        #   when the CA certificates are directly appended to the server
        #   certificate for convinience.
        #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

        #   Certificate Authority (CA):
        #   Set the CA certificate verification path where to find CA
        #   certificates for client authentication or alternatively one
        #   huge file containing all of them (file must be PEM encoded)
        #   Note: Inside SSLCACertificatePath you need hash symlinks
        #         to point to the certificate files. Use the provided
        #         Makefile to update the hash symlinks after changes.
        #SSLCACertificatePath /etc/ssl/certs/
        #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
        #   Certificate Revocation Lists (CRL):
        #   Set the CA revocation path where to find CA CRLs for client
        #   authentication or alternatively one huge file containing all
        #   of them (file must be PEM encoded)
        #   Note: Inside SSLCARevocationPath you need hash symlinks
        #         to point to the certificate files. Use the provided
        #         Makefile to update the hash symlinks after changes.
        #SSLCARevocationPath /etc/apache2/ssl.crl/
        #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl

        #   Client Authentication (Type):
        #   Client certificate verification type and depth.  Types are
        #   none, optional, require and optional_no_ca.  Depth is a
        #   number which specifies how deeply to verify the certificate
        #   issuer chain before deciding the certificate is not valid.
        #SSLVerifyClient require
        #SSLVerifyDepth  10

        #   SSL Engine Options:
        #   Set various options for the SSL engine.
        #   o FakeBasicAuth:
        #    Translate the client X.509 into a Basic Authorisation.  This means that
        #    the standard Auth/DBMAuth methods can be used for access control.  The
        #    user name is the `one line&#39; version of the client&#39;s X.509 certificate.
        #    Note that no password is obtained from the user. Every entry in the user
   #    file needs this password: `xxj31ZMTZzkVA&#39;.
        #   o ExportCertData:
        #    This exports two additional environment variables: SSL_CLIENT_CERT and
        #    SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
        #    server (always existing) and the client (only existing when client
        #    authentication is used). This can be used to import the certificates
        #    into CGI scripts.
        #   o StdEnvVars:
        #    This exports the standard SSL/TLS related `SSL_*&#39; environment variables.
        #    Per default this exportation is switched off for performance reasons,
        #    because the extraction step is an expensive operation and is usually
        #    useless for serving static content. So one usually enables the
        #    exportation for CGI and SSI requests only.
        #   o OptRenegotiate:
        #    This enables optimized SSL connection renegotiation handling when SSL
        #    directives are used in per-directory context.
        #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
        <FilesMatch &quot;\.(?:cgi|shtml|phtml|php)$&quot;>
                SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                SSLOptions +StdEnvVars
        </Directory>

        #   SSL Protocol Adjustments:
        #   The safe and default but still SSL/TLS standard compliant shutdown
        #   approach is that mod_ssl sends the close notify alert but doesn&#39;t wait for
        #   the close notify alert from client. When you need a different shutdown
        #   approach you can use one of the following variables:
        #   o ssl-unclean-shutdown:
        #    This forces an unclean shutdown when the connection is closed, i.e. no
        #    SSL close notify alert is send or allowed to received.  This violates
        #    the SSL/TLS standard but is needed for some brain-dead browsers. Use
        #    this when you receive I/O errors because of the standard approach where
        #    mod_ssl sends the close notify alert.
        #   o ssl-accurate-shutdown:
        #    This forces an accurate shutdown when the connection is closed, i.e. a
        #    SSL close notify alert is send and mod_ssl waits for the close notify
        #    alert of the client. This is 100% SSL/TLS standard compliant, but in
        #    practice often causes hanging connections with brain-dead browsers. Use
        #    this only for browsers where you know that their SSL implementation
        #    works correctly.
        #   Notice: Most problems of broken clients are also related to the HTTP
        #   keep-alive facility, so you usually additionally want to disable
        #   keep-alive for those clients, too. Use variable &quot;nokeepalive&quot; for this.
        #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
        #   their broken HTTP/1.1 implementation. Use variables &quot;downgrade-1.0&quot; and
        #   &quot;force-response-1.0&quot; for this.
        # BrowserMatch &quot;MSIE [2-6]&quot; \
        #       nokeepalive ssl-unclean-shutdown \
        #       downgrade-1.0 force-response-1.0
</VirtualHost>
Online now: No Back to the top

Post

Posted
Rating:
#931
Avatar
NOTS Staff
Regarding what's in the title bar (I assume you also mean URL bar), it's generally expected that whatever you type into the URL bar will stay there regardless of what webpage Apache sends back. The URL bar will only change if you do something like send an HTTP redirect header to actually redirect the web browser to a different URL, or include an HTML meta tag to do that. Otherwise, the configuration and fallbacks that Apache has in place are transparent to the client-side web browser. The browser doesn't know which Apache config file or Apache virtual hosts it's receiving data through.

I think I've spotted what you did wrong. This is your current owncast-le-ssl.conf file:

<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName live.seth.wtf
ServerAdmin seth@seth.wtf

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/live.seth.wtf/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/live.seth.wtf/privkey.pem
</VirtualHost>
</IfModule>

# Proxy traffic to/from Owncast.
ProxyRequests Off
ProxyPreserveHost On
AllowEncodedSlashes NoDecode

<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
RequestHeader set X-Forwarded-Proto &quot;https&quot;
RequestHeader set X-Forwarded-Port &quot;443&quot;

# Ensure websocket connections are also proxied.
RewriteEngine On
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:8080%{REQUEST_URI} [P,QSA,L]

You've correctly identified that all traffic is being redirected (or, rather, proxied) to port 8080. The reason is because you put that configuration after the closing </VirtualHost> tag, which means it's just general configuration you've applied to your server (any files before it are applied first, hence why the HTTP to HTTPS redirects are working, but the configuration is still being applied).

The "additional configuration" from Step 9 of my guide is supposed to go inside of the <VirtualHost> … </VirtualHost> block. That will restrict the configuration to only traffic destined for that virtual host. You can see where I inserted it at this timestamp of my video– I actually put it before the SSL certificate lines, although off the top of my head, I think putting it after those lines would behave the same, as long as it's inside of the VirtualHost block.

Let me know if that helps!
Online now: Yes Back to the top
1 guest and 0 members have just viewed this.