Use Apache to proxy through NGINX to MediaCMS (Server Install.)

[Ben-AR]

I am no linux guru but I was able to cobble this together after several days of researching. There was no single source of information and it was hit or miss with slow progress. Since I am already running Apache I did not want to re-invent everything in NGINX or use it as a proxy to Apache. I found no configurations for Apache to run MediaCMS directly. I am running an OPNsense router with HAProxy so I could have used it to redirect to NGINX running SSL on another port (say 10443) but I did not want to complicate the network or try to remember how it works if I made changes later and broke it.

This works by setting up Apache to proxy my subdomain media.example.com on (HTTPS) port 443 to the HTTP port 8080 on NGINX using the mediacms.io conf file. Also the MediaCMS file settings.py has to be modified so you don’t get a nasty CSRF error.

Hope this helps anyone else who may need to do the samething. Sorry but I will be of little help if it does not work for you.

Cheers!
-Ben

Ubuntu 20.04.6 LTS
Apache Apache/2.4.41 (Ubuntu)
nginx/1.18.0 (Ubuntu)
MediaCMs v3.1.0

Create Apache site conf file:

<VirtualHost *:443>

ServerName media.example.com  #   <---------------------------- Change ---------------------------------------------------

SSLEngine On
SSLProxyEngine On
#---------------------------------- Change your certs! --------------------------------------------
SSLCertificateFile /etc/letsencrypt/live/example.com-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/ example.com-0001-0001/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
#---------------------------------------------------------------------------------------------------

ProxyPreserveHost On

ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/

</virtualhost>

Enable new site:
a2ensite site_name_you_created

Enable Apache module:
a2enmod proxy_http

systemctl reload apache2

NGINX sites-available mediacms.io:

server {
    listen 8080 ;  <---------------------------Changed so it does not interfere with Apache (new proxy port) -------------------------------
    server_name media.example.com;   #   <---------------------------- Change ---------------------------------------------------

    gzip on;
    access_log /var/log/nginx/mediacms.io.access.log;

    error_log  /var/log/nginx/mediacms.io.error.log  warn;

#    # redirect to https if logged in
#    if ($http_cookie ~* "sessionid") {
#        rewrite  ^/(.*)$  https://localhost/$1  permanent;
#    }

#    # redirect basic forms to https
#    location ~ (login|login_form|register|mail_password_form)$ {
#        rewrite  ^/(.*)$  https://localhost/$1  permanent;
#    }

    location /static {
        alias /home/mediacms.io/mediacms/static ;
    }

    location /media/original {
        alias /home/mediacms.io/mediacms/media_files/original;
    }

    location /media {
        alias /home/mediacms.io/mediacms/media_files ;
    }

    location / {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
	add_header 'Content-Security-Policy' 'upgrade-insecure-requests'; #   <---------- Added-------------------------------------------

        include /etc/nginx/sites-enabled/uwsgi_params;
        uwsgi_pass 127.0.0.1:9000;
    }
}

server {
    listen 10443 ssl;     #<----------------------- Changed so it does not interfere with Apache (not needed for proxy) --------------------
    server_name media.example.com;   #   <---------------------------- Change ---------------------------------------------------
    ssl_certificate_key  /etc/letsencrypt/live/localhost/privkey.pem;
    ssl_certificate  /etc/letsencrypt/live/localhost/fullchain.pem;
    ssl_dhparam /etc/nginx/dhparams/dhparams.pem;

    ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;    
    ssl_ecdh_curve secp521r1:secp384r1;
    ssl_prefer_server_ciphers on;

    gzip on;
    access_log /var/log/nginx/mediacms.io.access.log;

    error_log  /var/log/nginx/mediacms.io.error.log  warn;

    location /static {
        alias /home/mediacms.io/mediacms/static ;
    }

    location /media/original {
        alias /home/mediacms.io/mediacms/media_files/original;
        #auth_basic "auth protected area";
        #auth_basic_user_file /home/mediacms.io/mediacms/deploy/local_install/.htpasswd;
    }

    location /media {
        alias /home/mediacms.io/mediacms/media_files ;
    }

    location / {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';

    include /etc/nginx/sites-enabled/uwsgi_params;
    uwsgi_pass 127.0.0.1:9000;
    }
}

systemctl reload nginx

MediaCMS settings file change:
settings.py: add CSRF_TRUSTED_ORIGINS = ['https://media.example.com']
systemctl restart mediacms

Cross your fingers…