Raja's Exocortex

Apache Config for Internal Apps using Let's Encrypt for SSL

This config shows how publish an website for internal use (restricted to access from private IPs only), but uses public domain and SSL from Let's Encrypt.

This setup has the advantage that internal apps can get valid SSL certificates without using an internal PKI or CA.

DNS Setup

Downside to this approach is that internal domain names are visible to the public.

# Filename: /etc/apache2/sites-available/app.example.com.conf
#
# Note:
# 1. HTTP and HTTPS config are in the same file
# 2. Use certbot for SSL certificate generation
# 3. Website is accessible only from private IPs, public IPs are denied
# 4. Certbot http validation is permitted from the internet

# Redirect all HTTP to HTTPS
<VirtualHost *:80>
    ServerName  app.example.com

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]
</VirtualHost>

<VirtualHost *:443>
    ServerName  app.example.com
    ServerAdmin webmaster@localhost

    DocumentRoot /srv/app.example.com/www

    ErrorLog ${APACHE_LOG_DIR}/app.example.com.error.log
    CustomLog ${APACHE_LOG_DIR}/app.example.com.access.log combined

    # Block external access, permit only private IPs
    <Directory "/srv/app.example.com/www">
        Options -Indexes
        AllowOverride All
        <RequireAny>
            Require ip 127.0.0.0/8
            Require ip 10.0.0.0/8
            Require ip 172.16.0.0/12
            Require ip 192.168.0.0/16
        </RequireAny>
    </Directory>

    # Permit certbot for Let's Encrypt certificate validation to pass
    <Location /.well-known/acme-challenge>
        Require all granted
    </Location>

    SSLEngine on

    SSLCertificateFile /etc/letsencrypt/live/app.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/app.example.com/privkey.pem
    Include     /etc/letsencrypt/options-ssl-apache.conf

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
    </Directory>

</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet