Apache2 + ProxyPass + Certbot
You might want to have an apache2 as a reverse proxy and have a web application running in a docker container. Obviously we don’t want to let the certbot to write into the docker container (neither want to mount any directory to the container) so we want to proxypass every request except the URL for the http01 resolver. The solution is below. It will proxy all requests to the web app on localhost, except the acme-challenge so the cert-bot http01 challenge will succeed.
<VirtualHost *:80> ServerName example.com DocumentRoot "/var/www/example.com" ProxyPreserveHost On
ProxyPass /.well-known/acme-challenge/ ! ProxyPass / http://127.0.0.1:8080/ ProxyPassReverse / http://127.0.0.1:8080/ </VirtualHost>
Also you want to redirect everything to https, except the acme challenge. So you need 2 block. One below to do the redirect (except the acme challenge), and another *:443 block with the ProxyPass.
<VirtualHost *:80> ServerName example.com DocumentRoot "/var/www/example.com" RewriteEngine On
RewriteCond %{HTTPS} !=on RewriteCond %{REQUEST_URI} !^/\.well-known/ RewriteRule ^/?(.*) https://example.com/$1 [R,L]
</VirtualHost>
<VirtualHost *:443> ServerName example.com DocumentRoot "/var/www/example.com" ProxyPreserveHost On SSLEngine on SSLCipherSuite AES256+EECDH:AES256+EDH SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLCompression off SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem ProxyPass / http://127.0.0.1:8080/ ProxyPassReverse / http://127.0.0.1:8080/ ErrorLog /var/log/apache2/example.com-error.log CustomLog /var/log/apache2/example.com-access.log combined </VirtualHost>
