JATOS with Apache (HTTPS with Let's Encrypt)

Comments

• kri

  November 2019

  Hi Yvonne,

  It's quite some time that I used Apache. But from what I remember your SSL setting looks fine.

  It would be helpful for me to see the rest of the Apache conf. And which version are you using?

  Kristian
• yvonne

  November 2019

  Hi Kristian,

  thank you for your time and help! I am using Ubuntu 18.10, Apache 2.4.34 and JATOS 3.3.2. Here is the content of the .conf file (server name is a placeholder).

  ServerName mydomain.com
  <VirtualHost *:80>
          ServerAdmin webmaster@localhost
          ServerName mydomain.com
          ServerAlias www.mydomain.com
          DocumentRoot /var/www/mydomain.com
          ErrorLog ${APACHE_LOG_DIR}/error.log
          CustomLog ${APACHE_LOG_DIR}/access.log combined
          # Redirect all unencrypted traffic to the respective HTTPS page
          Redirect "/" "https://www.mydomain.com/"
  </VirtualHost>
  
  <VirtualHost *:443>
    ServerName www.mydomain.com
  
    # Restrict access to JATOS GUI to local network
    # <Location "/jatos">
    #  Order deny,allow
    #  Deny from all
    #  Allow from 127.0.0.1 ::1
    #  Allow from localhost
    #  Allow from 192.168
    #</Location>
  
    # Needed for JATOS to get the correct host and protocol
    ProxyPreserveHost On
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Ssl "on"
  
    # Your certificate for encryption
    SSLEngine On
    SSLCertificateFile /etc/letsencrypt/live/mydomain.com/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/mydomain.com/fullchain.pem
  
    # JATOS uses WebSockets for its batch and group channels
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*)           ws://localhost:9000/$1 [P,L]
    RewriteCond %{HTTP:Upgrade} !=websocket [NC]
    RewriteRule /(.*)           http://localhost:9000/$1 [P,L]
  
    # Proxy everything to the JATOS running on localhost on port 9000 
    ProxyPass / http://localhost:9000/
    ProxyPassReverse / http://localhost:9000/
  </VirtualHost>
  

  If you think this is a problem of Apache and not JATOS, I can also try to ask for help somewhere else to not waste your time.

  Also, if you need more information, please let me know.

  Thank you again and best regards,

  Yvonne
• yvonne

  November 2019

  Just for info: I gave up on trying to solve this (nothing worked). I might try to use Nginx instead of Apache.
• kri

  November 2019

  Sorry Yvonne, I never answered. But I actually looked at your Apache config and couldn't find anything obviously wrong.

  Apache can be a bummer. It does not work until it works and then it is unbreakable.

  Actually I prefer Nginx too these days. You probable have seen the doc http://www.jatos.org/JATOS-with-Nginx.html.

  Or if you prefer Docker: JATOS + Traefik. With Traefik comes encryption out-of-the-box. But one looses a bit of control because everything is containerized. There is a doc about JATOS + Traefik on Digital Ocean http://www.jatos.org/JATOS-on-DigitalOcean.html. With a bit of adaptation this can be applied to any Linux system.

  If you have questions I'm happy to help. And if you are completely stuck I can have a look at your server.

  Best

  Kristian
• yvonne

  December 2019

  Hi Kristian,

  no worries, I just wanted to let people know that I was not looking for a solution for Apache + JATOS anymore.

  I switched to your recommendation (JATOS + Traefik) this morning and that worked like a charm, thank you!

  Before that, I did try Nginx, but I was not able to make it work either. Everything was running fine as long as I did not include the code chunk specific to JATOS. When I added that, I got the following warnings:

  nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/nginx.conf:66
  nginx: [warn] conflicting server name "www.mydomain.com" on 0.0.0.0:80, ignored
  nginx: [warn] conflicting server name "www.mydomain.com" on 0.0.0.0:443, ignored
  

  As far as I am aware, the line:

   ssl                  on;
  

  is causing the first warning because the command is no longer needed in newer versions of Nginx. Concerning the other warnings, I probably messed up the server names somehow. I thought it was maybe worth including this if someone runs into a similar problem in the future.

  For now, I am happy that https finally works. Thanks a lot!

  Best,

  Yvonne
• kri

  December 2019

  Hi Yvonne,

  Nice you got it working with Traefik! I'm glad I was of any help.

  Maybe I should add a page to JATOS docs "JATOS + Traefik" (without the whole Digital Ocean part).

  Regarding the "ssl" in the Nginx config: you might be right. I'm using Traefik lately and haven't tried recent versions of Nginx. I'll have a look and fix the JATOS docs. Thank you for pointing it out.

  Best,

  Kristian
• trig

  May 2020

  Hi Kristian and Yvonne,

  as both of you recommend that JATOS + Traefik is the easiest thing to do on your own server, I was wondering what code needs to be changed (from the DigitalOcean + Traefik example) in order to make it work on a Ubuntu server?
• kri

  May 2020

  Hi!

  First you would need to install docker and docker-compose. And then you would basically have to follow the little shell script from http://www.jatos.org/JATOS-on-DigitalOcean.html one by one. But you probably want to use a different user than root, so e.g. not /root/ but /home/my-user/.

  #!/bin/bash
  
  DOMAIN_NAME="my.domain.name"
  EMAIL="my.email@foo.com"
  
  curl https://raw.githubusercontent.com/JATOS/JATOS/master/deploy/docker-compose.yaml > /root/docker-compose.yaml
  curl https://raw.githubusercontent.com/JATOS/JATOS/master/deploy/traefik.toml > /root/traefik.toml
  
  sed -i "s/<DOMAIN_NAME>/${DOMAIN_NAME}/g" /root/docker-compose.yaml
  sed -i "s/<DOMAIN_NAME>/${DOMAIN_NAME}/g" /root/traefik.toml
  sed -i "s/<EMAIL>/${EMAIL}/g" /root/traefik.toml
  
  touch /root/acme.json
  chmod 600 /root/acme.json
  docker network create proxy
  docker-compose -f /root/docker-compose.yaml up -d
  

  Best,

  Kristian
• trig

  June 2020

  Thanks a lot. That helps!