Apache Reverse Proxy on OpenBSD

Yes using the DSO. What I did was have a gateway, hostA, and setup the Apache Proxy there. That host also runs static content from the same apache chroot. The internal machine, hostB, has three seperate Apache chroots, each running on a different (tcp) port. Some httpd.conf examples modified so the "tags" aren't interpreted:

hostA:
LoadModule proxy_module /usr/lib/apache/modules/libproxy.so

[IfModule mod_proxy.c]
ProxyRequests Off

[Directory proxy:*]
Order deny,allow
Deny from all
[/Directory]

[Directory proxy:http://internal1.example.net/]
Order deny,allow
Allow from all
[/Directory]

[Directory proxy:http://internal2.example.net/]
Order deny,allow
Allow from all
[/Directory]

ProxyVia Off
[/IfModule]

[VirtualHost 192.168.1.1]
ServerName internal1.example.net
ProxyPass / http://10.1.1.1:81/
ProxyPassReverse / http://10.1.1.1:81/
CustomLog logs/access_log.int1 combined
[Location /]
Order allow,deny
Allow from all
[/Location]
[/VirtualHost]
[VirtualHost 192.168.1.1]
ServerName internal2.example.net
ProxyPass / http://10.1.1.1:82/
ProxyPassReverse / http://10.1.1.1:82/
CustomLog logs/access_log.int2 combined
[Location /]
Order allow,deny
Allow from all
[/Location]
[/VirtualHost]


hostB is fairly straightforward in that there's a few directories like /var/www/int1 and /var/www/int2 - each of these is a stripped down version of what comes in /var/www by default (minus documentation) plus a /var/www/int1/usr directory to hold a copy of everything needed by perl and some things in /usr/lib that apache needs. A for loop in rc.local loops through and starts each one, the individual httpd.conf files specify listen port and chroot dir to match its location:

if [ "X$wwwdomains" != X"NO" -a -x /usr/sbin/httpd ]; then
for conffile in $wwwdomains; do
echo -n "HTTPD: starting $conffile ..."
/usr/sbin/httpd -f /var/www/$conffile/conf/httpd.conf
echo " done."
done
fi

and rc.conf has a line specifying each directory name with a live chroot:
httpd_flags=NO
wwwdomains="int1 int2"


The drawback I find with this approach is that the access_log on hostB is not so useful because of the requests coming from hostA. That's why each domain gets it own customlog on hostA.

I'm not sure this way is really any better, I just hadn't come across the issue you mentioned with needing hostnames in the config =) It just dawned on me, another thing that might affect that is having reverselookups off?

Caching can be an advantage or a disadvantage depending on the situation (-:

Pound has an advantage over general-purpose proxies: it is pretty good at detecting failed backend servers (if no data is received within a set time, it can send the request to another server without informing the client).

Another nice use for Pound is SSL offloading (I think Apache proxy can do this too, but I don't think Squid or Oops do this).

Here's a nice trick if you'd like resilience and load balancing: use CARP (or functional equivalent) on the servers, place a pf box before them on the network, and load-balance between the resilient IP addresses with an address pool in a rdr rule. This same trick works nicely for other protocols too, and I think it's quite an improvement over listing multiple A records (which is of course impossible where an IP address must be specified, e.g. DNS resolvers).