Question

这是我目前用于apache和工作的内容，但是如何添加http被重定向到https for plex？

<VirtualHost *:80>
    ServerName plex.mydomain.com

    ProxyRequests Off
    ProxyPreserveHost On
    ProxyPass / http://localhost:32400/
    ProxyPassReverse / http://localhost:32400/

    RewriteEngine on
    RewriteCond %{REQUEST_URI} !^/web
    RewriteCond %{HTTP:X-Plex-Device} ^$
    RewriteRule ^/$ /web/$1 [R,L]
</VirtualHost>

这适用于其他子域，但这对plex不起作用：

<VirtualHost *:80>
    ServerName somesub.mydomain.com

    RewriteEngine on
    RewriteCond %{HTTP_HOST} ^somesub.mydomain.com
    RewriteRule (.*) https://%{SERVER_NAME} [R,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName somesub.mydomain.com

    ProxyRequests Off
    ProxyPreserveHost On
    ProxyPass / http://localhost:5555/
    ProxyPassReverse / http://localhost:5555/
</VirtualHost>

Answer 1

这就是我现在正在使用的工具（Ubuntu 17.04，Apache2.4）

<VirtualHost *:80>
  ServerName my.sub.domain.com
  Redirect permanent / https://my.sub.domain.com/
</VirtualHost>

<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerName my.sub.domain.com
    ServerAlias ""
    Options -Includes -ExecCGI

    RewriteEngine On
    RewriteCond %{THE_REQUEST} !HTTP/1.1$
    RewriteRule .* - [F]

    LimitRequestBody 512000

    SSLEngine              On
    SSLCertificateFile    /etc/letsencrypt/live/my.sub.domain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/my.sub.domain.com/privkey.pem
    SSLProtocol           +TLSv1.2

    Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
    Header always set X-Frame-Options DENY
    FileETag None
    TraceEnable off
    #Header edit Set-Cookie ^(.*)$ ;HttpOnly;Secure
    Header set X-XSS-Protection "1; mode=block"
    Timeout 60

    <Location /:/websockets/notifications>
        ProxyPass wss://localhost:32400/:/websockets/notifications 
        ProxyPassReverse wss://localhost:32400/:/websockets/notifications
    </Location>

    <Proxy *>
    Order deny,allow
    Allow from all
    </Proxy>

    ProxyRequests Off
    ProxyPreserveHost On
    SSLProxyEngine On
    RequestHeader set Front-End-Https "On"

    ProxyPass / http://localhost:32400/
    ProxyPassReverse / http://localhost:32400/

    RewriteEngine on
    RewriteCond %{REQUEST_URI} !^/web
    RewriteCond %{HTTP:X-Plex-Device} ^$
    RewriteCond %{REQUEST_METHOD} !^(OPTIONS)$
    RewriteRule ^/$ /web/$1 [R,L]

  </VirtualHost>
</IfModule>

您需要将localhost（可能不是）和my.sub.domain.com更改为您自己的值并在重新启动Apache服务之前生成ssl证书（我使用LetsEncrypt）

这个vhost配置是我从众多帖子中改编而来的（一些来自这里，一些来自plex论坛）。它可能不完整或优化，但确实有效

有关详情/替代方案，请访问https://forums.plex.tv/

Answer 2

Alex的答案很好，但是要将流量从80重定向到443所需的全部就是添加到plex.conf文件中的以下代码行：

<VirtualHost *:80>
    ServerName plex.mydomain.com
    DocumentRoot /var/www/html
    ServerAdmin admin@plex.mydomain.com
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =plex.mydomain.com
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

作为参考，这是我的plex apache2 conf文件：

编辑：自2019年4月17日起更新。您将需要使用Apache2> = 2.4.11来使用它和几个mod（代理，ssl，proxy_wstunnel，http，dir，env，标头，proxy_balancer，proxy_http，重写我认为都是这些）：

<IfModule mod_ssl.c>
    DEFINE plex_url 192.168.1.22
    DEFINE plex_port 32400
    DEFINE serv_name plex.domain.com
    ServerTokens Prod
    SSLStaplingCache "shmcb:${APACHE_LOG_DIR}/stapling-cache(150000)"
    SSLSessionCache "shmcb:${APACHE_LOG_DIR}/ssl_scache(512000)"
    SSLSessionCacheTimeout 300
    ModPagespeed Off
<VirtualHost *:80>
    ServerName ${serv_name}
    DocumentRoot /var/www/html
    ServerAdmin aw@hell.no
    RewriteEngine On
    RewriteCond %{SERVER_NAME} =${serv_name}
    RewriteCond %{HTTPS} Off
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
    ErrorLog ${APACHE_LOG_DIR}/${serv_name}.error.log
    CustomLog ${APACHE_LOG_DIR}/${serv_name}.access.log combined
</VirtualHost>
<VirtualHost *:443>
    ServerName ${serv_name}
    DocumentRoot /var/www/html
    ServerAdmin aw@hell.no
    ErrorLog ${APACHE_LOG_DIR}/${serv_name}.error.log
    CustomLog ${APACHE_LOG_DIR}/${serv_name}.access.log combined
### Let's Encrypt Section ###
    SSLCertificateFile /etc/letsencrypt/live/${serv_name}/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/${serv_name}/privkey.pem
    #Include /etc/letsencrypt/options-ssl-apache.conf
    Options -Includes -ExecCGI
### Deny http1.0 requests ###
    RewriteEngine On
    RewriteCond %{SERVER_PROTOCOL} ^HTTP/1\.0$
    #RewriteCond %{REQUEST_URI} !^/404/$
    RewriteRule ^ - [F]
### Harden Security ###
    ProxyRequests Off
    ProxyPreserveHost On
    ProxyTimeout 600
    ProxyReceiveBufferSize 4096
    SSLProxyEngine On
    RequestHeader set Front-End-Https "On"
    ServerSignature Off
    SSLCompression Off
    SSLUseStapling On
    SSLStaplingResponderTimeout 5
    SSLStaplingReturnResponderErrors Off
    SSLSessionTickets Off
    RequestHeader set X-Forwarded-Proto 'https' env=HTTPS
    Header always set Strict-Transport-Security "max-age=15552000; preload"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Robots-Tag none
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"
    Header always set Feature-Policy "accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none';"
    Header always set Content-Security-Policy "default-src 'self' https:; font-src 'self' data: ${plex_url} ${serv_name}; media-src 'self' blob: ${plex_url} ${serv_name}; script-src 'self' 'unsafe-inline' ${plex_url} ${serv_name} plex.tv www.gstatic.com; style-src 'self' ${plex_url} ${serv_name}; img-src 'self' data: blob: ${plex_url} ${serv_name} plex.tv *.plex.tv; worker-src *; frame-src 'none'; connect-src 'self' wss: https: ${plex_url} ${serv_name} plex.tv *.plex.direct *.plex.tv;"
    SSLCipherSuite ECDHE+RSA+AES256+GCM+SHA512:DHE+RSA+AES256+GCM+SHA512:ECDHE+RSA+AES256+GCM+SHA384:DHE+RSA+AES256+GCM+SHA384:ECDHE+RSA+AES256+SHA384:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
    SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder On
### Plex Specific Section ###
    ProxyPass / http://${plex_url}:${plex_port}/
    ProxyPassReverse / http://${plex_url}:${plex_port}/
    ProxyPass /:/ ws://${plex_url}:${plex_port}/:/
    ProxyPassReverse /:/ ws://${plex_url}:${plex_port}/:/
    ProxyPass /:/ wss://${plex_url}:${plex_port}/:/
    ProxyPassReverse /:/ wss://${plex_url}:${plex_port}/:/
    LimitRequestBody 512000
    FileETag None
    TraceEnable off
    #Header edit Set-Cookie ^(.*)$ ;HttpOnly;Secure
    Timeout 60
    <Location /:/websockets/notifications>
        ProxyPass wss://${plex_url}:${plex_port}/:/websockets/notifications
        ProxyPassReverse wss://${plex_url}:${plex_port}/:/websockets/notifications
    </Location>
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>
    RewriteEngine on
    RewriteCond %{REQUEST_URI} !^/web
    RewriteCond %{HTTP:X-Plex-Device} ^$
    RewriteCond %{REQUEST_METHOD} !^(OPTIONS)$
    RewriteCond %{QUERY_STRING} (^|&)X-Plex-Device=(&|$) [OR]
    RewriteCond %{QUERY_STRING} !(^|&)X-Plex-Device=
    RewriteRule ^/$ /web/$1 [R,L]
</VirtualHost>
</IfModule>

如何为子域和https 443后面的plex配置apache？

2 个答案: