# Discovery server behind an Apache reverse proxy

**URL:** https://forum.syncthing.net/t/discovery-server-behind-an-apache-reverse-proxy/7121
**Category:** Howto
**Created:** [April 5, 2016, 4:20pm UTC](https://forum.syncthing.net/t/discovery-server-behind-an-apache-reverse-proxy/7121 "2016-04-05T16:20:01Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Micha](https://forum.syncthing.net/letter_avatar_proxy/v4/letter/m/c37758/32.png) [@Micha](https://forum.syncthing.net/u/Micha)
#### Post date: [April 5, 2016, 4:20pm UTC](https://forum.syncthing.net/t/discovery-server-behind-an-apache-reverse-proxy/7121/1 "2016-04-05T16:20:01Z")

</div>

Hi Scott

Thanks a lot for your discussion here: [Using reverse-proxied nginx and subdomain with self-hosted, Dockerized discovery server](https://forum.syncthing.net/t/using-reverse-proxied-nginx-and-subdomain-with-self-hosted-dockerized-discovery-server/6849)

Therefore I was able to setup my own discovery server / Apache reverse proxy installation. Unfortunately, I am not able to create my own topic within ‘howto’ category. Maybe my account is too fresh 😉

I have a SSL wildcard certificate (\*.domain.tld). My Apache webserver has enabled the modules ‘ssl’, ‘headers’, ‘proxy’ and ‘proxy\_http’. The following lines are required within the Apache config:

```
<VirtualHost x.x.x.x:443>
    ServerName discovery.domain.tld
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/cert.crt
    SSLCertificateKeyFile /etc/apache2/ssl/cert.key
    SSLCertificateChainFile /etc/apache2/ssl/intermediate.crt

    SSLProxyEngine On
    SSLVerifyClient optional_no_ca
    ProxyPass / http://internal.domain.tld:8443/
    ProxyPassReverse / http://internal.domain.tld:8443/
    RequestHeader set X-SSL-Cert "%{SSL_CLIENT_CERT}s"
</VirtualHost>

```

The two important steps are the same as in your solution. You have to request the client to present a certificate and you have to forward that certificate within the header to the discovery server.

Hint: It is not necessary to have a wildcard certificate. Without that you have to work with a deeper link structure: **ssl.domain.tld/discovery** and you have to change the two lines with ‘ProxyPass’ and ‘ProxyPassReverse’ accordingly.

At first I downloaded the current Linux binary for discovery server. That’s missing the ‘-http’ option. I had to download the current source from GitHub and compile it by my own.

Cheers Micha

---

<div class="post-metadata">

### Author: ![canton7](https://forum.syncthing.net/user_avatar/forum.syncthing.net/canton7/32/9528_2.png) [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [April 5, 2016, 4:35pm UTC](https://forum.syncthing.net/t/discovery-server-behind-an-apache-reverse-proxy/7121/2 "2016-04-05T16:35:25Z")

</div>

(Moved to a new topic in Howto)

---

<div class="post-metadata">

### Author: ![AudriusButkevicius](https://forum.syncthing.net/user_avatar/forum.syncthing.net/audriusbutkevicius/32/277_2.png) [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [April 5, 2016, 5:54pm UTC](https://forum.syncthing.net/t/discovery-server-behind-an-apache-reverse-proxy/7121/3 "2016-04-05T17:54:44Z")

</div>

I would appreciate if you’d make a pull request to the docs explaining how to do this. Especially the SSL handoff to the discovery server, as thats the trickiest bit here.

---

<div class="post-metadata">

### Author: ![Micha](https://forum.syncthing.net/letter_avatar_proxy/v4/letter/m/c37758/32.png) [@Micha](https://forum.syncthing.net/u/Micha)
#### Post date: [April 11, 2016, 6:47am UTC](https://forum.syncthing.net/t/discovery-server-behind-an-apache-reverse-proxy/7121/5 "2016-04-11T06:47:02Z")

</div>

Sure! Here [https://docs.syncthing.net/users/reverseproxy.html](https://docs.syncthing.net/users/reverseproxy.html) or there [https://docs.syncthing.net/users/discosrv.html](https://docs.syncthing.net/users/discosrv.html) ???

---

<div class="post-metadata">

### Author: ![AudriusButkevicius](https://forum.syncthing.net/user_avatar/forum.syncthing.net/audriusbutkevicius/32/277_2.png) [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [April 11, 2016, 8:14am UTC](https://forum.syncthing.net/t/discovery-server-behind-an-apache-reverse-proxy/7121/6 "2016-04-11T08:14:49Z")

</div>

Add a new section/page under discosrv