ssl - Proper way to host WordPress behind a load balancer with TLS offloading and the PROXY protocol

admin2025-05-31  0

There's a lot of information on how to make WordPress 'work' behind a reverse proxy or load balancer when using TLS offloading at the edge. A lot of these workarounds involve hacking up the wp-config.php file and passing the X-Forwarded-Proto header down stream to the web server sitting in front of WordPress and then to WordPress itself.

That's all fine, but these methods assume you are NOT using the Proxy Protocol (version 2).

I'd like to know what's the correct and most cleanest way to tell WordPress that TLS is being offloaded by something else and it shouldn't try to redirect the requests to HTTPS, thus causing a redirect loop.

The architecture is as follows:

  • TLS is handled by Hitch and then sending off a plain HTTP request to Varnish cache via the PROXY protocol. From this point forward it's plain text HTTP.
  • Varnish is then sending the request over to HAProxy also via the PROXY protocol.
  • HAProxy sends the request to the backend servers via the PROXY protocol
  • The backend servers have (yes another proxy on them) Apache Traffic Server, which also sends the request to the final destination, an Apache HTTP server, once again with the PROXY protocol.
  • Apache serves the WordPress site.

End-to end from the edge all the way to the HTTP server in front of Wordpress, the PROXY protocol is in use. The pipeline is long but it's that way for a reason. Sure there's room for improvement, but that's not the topic for this question.

How should I configure the Apache web server and WordPress?

For example, is there a way to set these Apache directives using information passed by the PROXY protocol?

RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
RequestHeader set "X-Forwarded-SSL" expr=%{HTTPS}

Or is there a much more elegant approach to solving the problem?

转载请注明原文地址:http://conceptsofalgorithm.com/Algorithm/1748625461a313614.html

最新回复(0)