peppy

Install LetsEncrypt On Subdomain With Phoenix / Apache2

Greetings,

I finally got Phoenix working on a sub-domain of my website. However, I still need to get an SSL certificate set up, and I’m getting weird errors. Here is my Apache configuration so far for the sub-domain:

<VirtualHost *:80>
    ServerAdmin admin@mywebsite.com
    ServerName ex.mywebsite.com
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =ex.mywebsite.com
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>
    ServerAdmin admin@mywebsite.com
    ServerName ex.mywebsite.com
    DocumentRoot /home/username/mywebsite.com
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    RewriteEngine on
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/?(.*) "ws://127.0.0.1:4000/$1" [P,L]

    ProxyRequests Off
    ProxyPass        / http://127.0.0.1:4000/
    ProxyPassReverse / http://127.0.0.1:4000/

    ProxyPass        /socket/ ws://127.0.0.1:4000/socket/
    ProxyPassReverse /socket/ ws://127.0.0.1:4000/socket/
</VirtualHost>

Here is the command I run to try installing LetsEncrypt:

sudo certbot --http-01-port 4000 --authenticator webroot --webroot-path /home/username/mywebsite.com --installer apache -n -d ex.mywebsite.com

It results in this error:

   Domain: ex.mywebsite.com
   Type:   unauthorized
   Detail: Invalid response from
   https://ex.mywebsite.com/.well-known/acme-challenge/n6pcuMgsQhBtpHd2reDEZpI57fZnVoPo1JbaUNopmtY
   [***.***.***.***]: "<!DOCTYPE html>\n<html>\n<head>\n    <meta
   charset=\"utf-8\">\n    <title>Phoenix.Router.NoRouteError at GET
   /.well-known/acme-challen"

What should I do to get it to install correctly?

Also, for no particular reason, I’m using the same document root “/home/username/mywebsite.com” that I use for my main website. What is the standard practice for the location of the document root? Should I be using something like this instead: “/home/username/HelloWeb”? With HelloWeb being the folder where the my Phoenix project was installed?

Ultimately, I’ll probably just be loading up the Phoenix JavaScript as an external file “https://ex.mywebsite.com/js/app.js” through my main website “https://www.mywebsite.com” and developing my own front-end designs through the main website.

Thanks

16 comments

/phoenix #ssl #apache

0 2029 16

2021-11-17 02:22:46 UTC

Marked As Solved

peppy

Sure, no problem. Basically, I came across a good solution here: https://stackoverflow.com/questions/37216626/elixir-phoenix-production-server-has-issue-with-letsencrypt-renewal

In the router.ex file, I set up a snipet for the .well-known directory:

  scope "/.well-known", MyAppWeb do
   pipe_through :browser

   get "/acme-challenge/:challenge", AcmeChallengeController, :show
  end

and then a new controller letsencrypt.ex:

  defmodule MyAppWeb.AcmeChallengeController do
   use MyAppWeb, :controller

   def show(conn, %{"challenge" => "the_random_file_name"}) do
      send_resp(conn, 200, "TheHashInTheFile")
   end

   def show(conn, _) do
      send_resp(conn, 200, "Not valid")
   end
end

Lastly, you’ll need to do the certbot call using the /assets/static (or /priv/static) directory as the web root:

sudo certbot --authenticator webroot --webroot-path /home/username/myapp/assets/static --installer apache -n -d ex.mysite.com

Once that is done, everything was made fun for the long haul.

Post #16

Also Liked

derek-zhou

The error is because you are forwarding everything to phoenix, including the cerbot’s challenge, which is a static file generated on the fly by certbot. The easiest thing to do is to get the certbot working before setting up any reverse proxy. You do not nee the challenge response to renew the cert, only for the initial setup.

Post #1