{"componentChunkName":"component---node-modules-gatsby-theme-blog-core-src-templates-post-query-js","path":"/reverse-proxy-tomcat-for-https/","result":{"data":{"site":{"siteMetadata":{"title":"one melo a day","social":[{"name":"twitter","url":"https://twitter.com/melo0187"},{"name":"github","url":"https://github.com/melo0187"}]}},"blogPost":{"__typename":"MdxBlogPost","id":"cc61ba89-f4d5-568a-900c-3dbf978095ae","excerpt":"How to use DSM 6 reverse proxy for easy HTTPS access to Tomcat","body":"function _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"layout\": \"post\",\n  \"title\": \"Reverse Proxy Tomcat for easy HTTPS\",\n  \"author\": \"melo\",\n  \"date\": \"2016-05-27T14:17:05.000Z\",\n  \"categories\": [\"DiskStation\", \"https\", \"Let's Encrypt\", \"Technical\", \"Tomcat\"],\n  \"slug\": \"reverse-proxy-tomcat-for-https\",\n  \"excerpt\": \"How to use DSM 6 reverse proxy for easy HTTPS access to Tomcat\",\n  \"draft\": false,\n  \"meta_title\": \"Reverse Proxy Tomcat for easy HTTPS\"\n};\n\nvar makeShortcode = function makeShortcode(name) {\n  return function MDXDefaultShortcode(props) {\n    console.warn(\"Component \" + name + \" was not imported, exported, or provided by MDXProvider as global scope\");\n    return mdx(\"div\", props);\n  };\n};\n\nvar Connector = makeShortcode(\"Connector\");\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, [\"components\"]);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"p\", null, \"After having written abundantly about the problems I faced when updating my DiskStation to DSM 6 I am now happy to write about the new features of Synology\\u2019s latest OS version. In particular the Let\\u2019s Encrypt integration and the ability to configure a reverse proxy right from the GUI. If you are interested in how to combine these features to easily set up HTTPS access to your Tomcat 7 (and potentially other application servers) on your DiskStation, this if for you.\"), mdx(\"h2\", {\n    \"id\": \"havent-we-done-that\"\n  }, \"Haven\\u2019t we done that?\"), mdx(\"p\", null, \"If you were following this blog, you might have noticed that I already described both \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://melo.myds.me/wordpress/get-https-on-diskstation-with-lets-encrypt/\"\n  }), \"how to get a Let\\u2019s Encrypt certificate for your Diskstation\"), \" and \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://melo.myds.me/wordpress/lets-encrypt-for-tomcat-7-on-ds/\"\n  }), \"how to use the same certificate to serve your Tomcat apps through HTTPS\"), \". If you are not familiar with HTTPS and Let\\u2019s Encrypt, I invite you to read these older posts upfront. The approach described in my two older posts worked just fine and allowed me to encrypt all traffic coming to my DiskStation with a trusted certificate months before Synology integrated Let\\u2019s Encrypt support directly into DSM. However the described method had a few shortcomings:\"), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"Let\\u2019s Encrypt client did not run on the DiskStation itself\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"manual process to generate and import certificates\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"separate manual process to create keystore for Tomcat\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"repeat both manual processes every 90 days for renewal\")), mdx(\"p\", null, \"For these reasons my old way of doing this could not be a long term solution. Thankfully DSM 6 integrated Let\\u2019s Encrypt support, which allows fully automated certificate creation and renewal for their DSM 6 compatible products. However this takes care of Synology\\u2019s own web applications and the things you serve from your DiskStation through Synology\\u2019s Web Station, only. In my old setup I allowed direct access to Tomcat by forwarding its HTTPS port and thus had to configure HTTPS support in Tomcat separately. This means although DSM 6 automatically creates and renews certificates, I would still be required to do the manual steps I described in my \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://melo.myds.me/wordpress/lets-encrypt-for-tomcat-7-on-ds/\"\n  }), \"old post\"), \" to use the certificate for Tomcat, too. To avoid this I needed to somehow \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"make Tomcat accessible through the internet using HTTPS \", mdx(\"em\", {\n    parentName: \"strong\"\n  }, \"without\"), \" requiring Tomcat itself to handle HTTPS connections directly\"), \". This is where the new reverse proxy feature comes into play!\"), mdx(\"h2\", {\n    \"id\": \"what-is-a-reverse-proxy\"\n  }, \"What is a reverse proxy?\"), mdx(\"p\", null, \"WikiPedia offers the following defintion:\"), mdx(\"blockquote\", null, mdx(\"p\", {\n    parentName: \"blockquote\"\n  }, \"[\", \"\\u2026\", \"]\", \" a reverse proxy is a type of proxy server that retrieves resources on behalf of a client from one or more servers. These resources are then returned to the client as though they originated from the proxy server itself.\", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"#fn-154-1\"\n  }), \"1\"))), mdx(\"p\", null, \"So this means you can have a reverse proxy to handle all client requests, do the HTTPS encryption and decryption and thus become your internet facing entry point to another server that actually contains the resources your clients are requesting. The server itself does not need to be accessible through the internet anymore and does not need to take care of HTTPS. In my scenario Synology\\u2019s Web Station (which is basically a pre-configured NGINX web server) would be the HTTPS enabled reverse proxy and Tomcat would be the server. This way we do not need to allow direct internet access to Tomcat and do not need to teach Tomcat how to use our certificate for HTTPS. Instead we have only Web Station taking care of handling HTTPS traffic. Sounds good, right? So let\\u2019s see how to get this done!\"), mdx(\"h2\", {\n    \"id\": \"get-https-the-easy-way\"\n  }, \"Get HTTPS: The easy way\"), mdx(\"p\", null, \"First of all we need a Let\\u2019s Encrypt certificate, of course. You can do this in DSM 6 by going to \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"Control Panel\"), \" -> \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"Security\"), \" and clicking on the tab \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"Certificate\"), \". I won\\u2019t describe the process, since it is really nothing more than clicking through a wizard and providing a few details. A fellow blogger already described in detail how to use this new feature. Check out his post \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://stefandingemanse.nl/how-to-use-lets-encrypt-ssl-certificate-on-synology-dsm/\"\n  }), \"here\"), \"! There is only one thing to note: During certificate creation be sure to provide an alternative name, that is the domain you want to use for accessing your Tomcat apps. So if you have a domain like  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"you.myds.me\"), \" , you could use something like  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"tomcat.you.myds.me\"), \"  as an alternative name. Once you are done, you can access all web sites and applications on your Synology through HTTPS! So  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"https://you.myds.me\"), \"  would serve whatever you have as index inside your web folder,  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"https://you.myds.me/photo\"), \"  would grant you HTTPS access to your Photo Station and so on. Now on to setting up the reverse proxy feature for your new  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"tomcat.you.myds.me\"), \"  domain. Once logged in to DSM go to \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"Control Panel\"), \" -> \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"Application Portal\"), \" and click on the tab \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"Reverse Proxy\"), \". There you can setup the reverse proxy feature for redirecting HTTPS requests hitting  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"https://tomcat.you.myds.me\"), \"  to your local, HTTP Tomcat address ( \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"localhost:7070\"), \"  by default). The configuration should look like in the following screenshot: \", \"[\", \"caption id=\\u201Cattachment\", \"_\", \"266\\u201D align=\\u201Caligncenter\\u201D width=\\u201C278\\u201D\", \"]\", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://melo.myds.me/wordpress/wp-content/uploads/2016/05/dsm6_reverse_proxy_tomcat.png\"\n  }), mdx(\"span\", _extends({\n    parentName: \"a\"\n  }, {\n    \"className\": \"gatsby-resp-image-wrapper\",\n    \"style\": {\n      \"position\": \"relative\",\n      \"display\": \"block\",\n      \"marginLeft\": \"auto\",\n      \"marginRight\": \"auto\",\n      \"maxWidth\": \"278px\"\n    }\n  }), \"\\n      \", mdx(\"span\", _extends({\n    parentName: \"span\"\n  }, {\n    \"className\": \"gatsby-resp-image-background-image\",\n    \"style\": {\n      \"paddingBottom\": \"107.91366906474819%\",\n      \"position\": \"relative\",\n      \"bottom\": \"0\",\n      \"left\": \"0\",\n      \"backgroundImage\": \"url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAWCAYAAADAQbwGAAAACXBIWXMAAAsSAAALEgHS3X78AAACnUlEQVQ4y4VVy3ITMRD0R/IJfA9XLhQF3DnkRMI3BMiBXEKqKKASB3tf0kra1WubGe3DWtuAq7pmV4/enpmWvLn4KvDx3uDym8YVgePlncaHO4XXnyXefJF4eyPT8zuKrz4JvL9t01pecznvmbBRnUWMASEEeO8xDAPm304HPKmA0gTsKBb0vm0DlDusOf5thOpQVhWqRqKoarRKp4m4EJ9uHmIkAYQpxjgkIbxnI3QP0TSoiFRKCebhyRGA8yF9aFdUhJKem0Tiw5gVz/P7vGejO4e97PFQGwhtk6IDIX2VVHR9D9MxuvTMinicwSpjtj4RlibihwgQfWR504YJwxFoLIRR1YKMlJri0GlFaVfwzo41GtYqZavwtNvDOj+pHhZ12nQJ875EqI3BnmrUiPaELBFSo4qypnkJIVvUzRgdfSCB3DGXKhEqpdJiJp47loM3M2HdCFQ1NZAir7cT2Ug4K+yZsEVv3TIYjxVKBa1NVo4xzt1mLE0xRFhQU/aNQl3XKGtOTZzUMu/sAeNYvi4RbluPbUVpJZ/VVM9ylcaM0eSnWBFqIjSOpDuHYDsEb5PfOI1zHf8fFh/+JB/+ImxVPKNsOXQrpfncirAxDo/C4rd06SI4NjVbg5s2NiBOzRgjHz3vs6aozsOQsZu6QnDuTJpItinJLkw+d5VJ2NjmnLHNZGz213HXGHwD8cXA86xo9t4BITe2R9u2dLzYi/assfkEPe0KKPLimjBkJwUHQq11cv3ZrtIYp8TnOdWT6zYhTOc5d8Sm7ca6xeWyjH8xMB8PdsAaaTzvMhOON3DIcLia4qKArNV4vLju8fLGUrS4L11qStFQyeii5vWLwn+Zdf47uN17PLtQeH6lU7x+tJB0SXx/2KEUOqX/BxqwsgzdMJPhAAAAAElFTkSuQmCC')\",\n      \"backgroundSize\": \"cover\",\n      \"display\": \"block\"\n    }\n  })), \"\\n  \", mdx(\"img\", _extends({\n    parentName: \"span\"\n  }, {\n    \"className\": \"gatsby-resp-image-image\",\n    \"alt\": \"reverse proxy setup for Tomcat\",\n    \"title\": \"reverse proxy setup for Tomcat\",\n    \"src\": \"/static/61c4cb1444b1f3e4e0fb65abcdf1eb0b/e14eb/dsm6_reverse_proxy_tomcat-278x300.png\",\n    \"srcSet\": [\"/static/61c4cb1444b1f3e4e0fb65abcdf1eb0b/e14eb/dsm6_reverse_proxy_tomcat-278x300.png 278w\"],\n    \"sizes\": \"(max-width: 278px) 100vw, 278px\",\n    \"loading\": \"lazy\"\n  })), \"\\n    \")), \" reverse proxy setup for Tomcat\", \"[\", \"/caption\", \"]\", \" Hit ok to apply these new settings, but don\\u2019t call  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"https://tomcat.you.myds.me\"), \"  just yet! For Tomcat and its deployed applications to work correctly, there is one more action to take. Our last step is to reconfigure Tomcat\\u2019s default HTTP connector to let it know the proxy port and the scheme, because Tomcat needs to be explicitly told that it\\u2019s being proxied through port 443(SSL)\", mdx(\"img\", _extends({\n    parentName: \"p\"\n  }, {\n    \"src\": \"#fn-154-2\",\n    \"alt\": \"2\"\n  })), \" Tomcat\\u2019s connectors are configured inside the \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"server.xml\"), \" file, which in my case is located in  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"/volume1/@appstore/Tomcat7/src/conf\"), \" . So connect to your DiskStation through SSH, find the server.xml file, locate the currently active port 7070 connector and add the attributes \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"proxyPort\"), \" and \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"scheme\"), \" like highlighted in line 5 and 6 of the following example: \", \"[\", \"code language=\\u201Cxml\\u201D highlight=\\u201C5,6\\u201D\", \"]\", \" \", mdx(Connector, {\n    port: \"7070\",\n    protocol: \"HTTP/1.1\",\n    connectionTimeout: \"20000\",\n    redirectPort: \"8443\",\n    URIEncoding: \"UTF-8\",\n    proxyPort: \"443\",\n    scheme: \"https\",\n    mdxType: \"Connector\"\n  }), \" \", \"[\", \"/code\", \"]\", \" Save your changes to the server.xml file, restart Tomcat (you can use DSM Package Center for that) and voila! You can now access Tomcat through HTTPS by calling  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"https://tomcat.you.myds.me\"), \" ! If you have an app deployed to Tomcat, let\\u2019s say Jenkins, you can access it through HTTPS by calling  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"https://tomcat.you.myds.me/jenkins\"), \" , accordingly.\"), mdx(\"h2\", {\n    \"id\": \"reaping-the-rewards\"\n  }, \"Reaping the rewards\"), mdx(\"p\", null, \"Congratulations! You can now access all your DiskStaion\\u2019s websites and applications - even the ones served with Tomcat - through HTTPS using a valid Let\\u2019s Encrypt certificate. And the best thing about it: This was a one time setup! The certificate will be renewed by DSM 6 automatically. You will not need to recreate the certificate yourself nor will you need to change anything in Tomcat. This is exactly the lazy-friendly, long term approach I was looking for!\"), mdx(\"hr\", null), mdx(\"ol\", null, mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"From \", mdx(\"a\", _extends({\n    parentName: \"li\"\n  }, {\n    \"href\": \"https://en.wikipedia.org/wiki/Reverse_proxy\"\n  }), \"Wikipedia\"), \", on the 26th of May 2016\\xA0\", mdx(\"a\", _extends({\n    parentName: \"li\"\n  }, {\n    \"href\": \"#fnref-154-1\"\n  }), \"\\u21A9\")), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"From the blog \", mdx(\"a\", _extends({\n    parentName: \"li\"\n  }, {\n    \"href\": \"http://webapp.org.ua/sysadmin/setting-up-nginx-ssl-reverse-proxy-for-tomcat/\"\n  }), \"Weird rocketry\"), \"\\xA0\", mdx(\"a\", _extends({\n    parentName: \"li\"\n  }, {\n    \"href\": \"#fnref-154-2\"\n  }), \"\\u21A9\"))));\n}\n;\nMDXContent.isMDXComponent = true;","slug":"/reverse-proxy-tomcat-for-https/","title":"Reverse Proxy Tomcat for easy HTTPS","tags":[],"keywords":[],"date":"May 27, 2016"},"previous":{"__typename":"MdxBlogPost","id":"452c8961-03cc-5f64-bb2b-1eb34800b2de","excerpt":"How to fix Piwik after updating to DSM 6","slug":"/fix-piwik-after-dsm6-update/","title":"DSM 6 Adventures: Fixing Piwik","date":"May 15, 2016"},"next":{"__typename":"MdxBlogPost","id":"85e8ac74-84c8-5557-a454-43b08deb85b4","excerpt":"It is when you start your weekend and notice that your certificates expired, that you start spending your free time on things you actually…","slug":"/enjoying-automatic-lets-encrypt-certificate-renewal/","title":"Enjoying automatic Let's Encrypt certificate renewal","date":"June 18, 2016"}},"pageContext":{"isCreatedByStatefulCreatePages":false,"id":"cc61ba89-f4d5-568a-900c-3dbf978095ae","previousId":"452c8961-03cc-5f64-bb2b-1eb34800b2de","nextId":"85e8ac74-84c8-5557-a454-43b08deb85b4"}}}