[{"_1":2,"_191":-5,"_192":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_166":167},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_89":90,"_111":112,"_155":-5,"_156":11,"_157":21,"_158":11,"_159":-5,"_160":11,"_161":-5,"_162":163,"_164":113,"_165":-7},"canonicalUrl","https://hub.docker.com/r/thundersquared/apiscp-cp-proxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","thundersquared","reponame","apiscp-cp-proxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":73,"_74":75,"_80":11,"_81":82,"_86":33,"_87":88},"categories",[],"content_types",[44],"image","date_registered","2021-12-04T21:41:38.347145Z","description","","is_private","last_updated","2021-12-04T21:53:16.779249Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",261,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","

\n $\"ApisCP$ \n

\n\nApisCP panel proxy provides a centralized login portal for all participating ApisCP nodes. Panel proxy\nconsists of three components: (1) reverse proxy **cp-proxy**, (2) aggregation client **cp-collect**, and \n(3) API service **cp-api**.\n\nThis is the reverse proxy service that directs requests to the proper server.\n\n## Background\n\ncp-proxy is a reverse proxy that allows coordination between multiple, similar applications in which the application will push a request to another server via 307 redirect to another server if the account resides elsewhere. cp-proxy doubles as a simple method of upgrading normal, unencrypted HTTP sessions to HTTPS by placing a performant SSL terminator in front of the proxy.\n\n## Quickstart\n\nThe following quickstart assumes a DNS-only or dev-only server that will not host any sites. These free licenses may be requested via [my.apiscp.com](https.my.apiscp.com). A DNS-only machine may be provisioned on a 1 GB machine using the following install command.\n\n```bash\ncurl https://raw.githubusercontent.com/apisnetworks/apiscp-bootstrapper/master/bootstrap.sh | bash -s - -s use_robust_dns='true' -s always_permit_panel_login='true' -s has_dns_only='true' -s has_low_memory='true' -s dns_default_provider='null' -s anyversion_node='true' -s system_hostname='cp.mydomain.com' -s apnscp_admin_email='blackhole@apiscp.com'\n```\n`anyversion_node` allows using a non-system Node version (v10) for cp-proxy. `apnscp_admin_email` and `system_hostname` are required to arm the server with a valid SSL certificate.\n\n::: tip Low low-memory\nApisCP is intended to work on 2 GB machines, but low-memory mode allows it to work on 1 GB machines. Not all 1 GB machines are provisioned consistently causing discrepancy in available memory for the guest. Add `-s limit_memory_1gb=500` to reduce the minimum memory check to \"500 MB\".\n:::\n\n```bash\nuseradd -rms /sbin/nologin cp\ncd /home/cp\nsudo -u cp git clone https://github.com/apisnetworks/cp-proxy.git /home/cp/proxy\ncp /home/cp/proxy/cp-proxy.sysconf /etc/sysconfig/cp-proxy\n# Now is a good time to edit /etc/sysconfig/cp-proxy!\ncp /home/cp/proxy/cp-proxy.service /etc/systemd/system\nsudo -u cp /bin/bash -ic 'nvm install 10 ; cd /home/cp/proxy/ ; nvm exec npm install'\nsystemctl enable --now cp-proxy\n```\n\nNext connect Apache to it by modifying /etc/httpd/conf/httpd-custom.conf within the SSL VirtualHost container. \nPagespeed is disabled, which is known to cause interference with assets.\n\n```\n\n Listen 443 \n \n ServerName cp.mydomain.com\n SSLEngine On\n RewriteEngine On\n RewriteOptions Inherit\n # --- Add below ---\n # Disable gzip compression\n \n ModPagespeed unplugged\n \n\n # Pass HTTPS status\n RequestHeader set X-Forwarded-Proto \"https\"\n # Add this line, note trailing /\n ProxyPass / http://localhost:8021/\n # And this line, note trailing /\n ProxyPassReverse / http://localhost:8021/\n # -^- Add above -^-\n \n\n\n```\n\nNext, reconfigure ApisCP to listen on a private network for the cp-proxy service.\n\n```bash\ncpcmd scope:set cp.bootstrapper has_proxy_only true\ncpcmd scope:set cp.bootstrapper cp_proxy_ip 127.0.0.1\n# Regenerate httpd-custom.conf in ApisCP\nenv BSARGS=\"--extra-vars=force=yes\" upcp -sb apnscp/bootstrap\n```\n\nRun `htrebuild`, then visit [https://cp.mydomain.com](https://cp.mydomain.com/). You're done!\n\n---\n\nBy default, cp-proxy will read from [http://127.0.0.1:2082](http://127.0.0.1:2082/). On a DNS-server this hosts no domains, which requires configuration below to route.\n\n## Configuration\n\nAll configuration must be changed in `config/custom/config.ini`. [cpcmd](https://docs.apiscp.com/admin/CLI/#cpcmd) provides a short-hand means of doing this, e.g.\n\n```\ncpcmd scope:set cp.config

\n```\n\n| Section | Name | Description | Sample Value |\n| ------- | -------------------- | ------------------------------------------------------------ | --------------------------------------------------- |\n| auth | secret | Must be the same across *all* instances. Used to encrypt trusted browsers. | ABCDEFGH |\n| auth | server_format | Optional format that appends a domain to the result of *server_query*. is substituted with result from JSON query. | .mydomain.com |\n| auth | server_query | API endpoint that returns a JSON object with the server name. | https://api.mydomain.com/lookup |\n| core | http_trusted_forward | [cp-proxy](https://github.com/apisnetworks/cp-proxy) service IP address. | 1.2.3.4 |\n| misc | cp_proxy | Control panel proxy endpoint that cp-proxy resides on. | [https://cp.mydomain.com](https://cp.mydomain.com/) |\n| misc\t| sys_status\t| Optional Cachet location for system status\t| https://demo.cachethq.io/ |\n\nFor the lazy scholars, these values can be easily imported from an existing machine:\n\n```bash\nfor i in auth,secret auth,server_format auth,server_query core,http_trusted_forward misc,cp_proxy, misc,sys_status ; do \n\tIFS=\",\"\n\tset -- $i\n\tsection=$1\n\tvalue=$2\n\techo \"cpcmd scope:set cp.config $section $value '$(cpcmd scope:get cp.config $section $value)'\"\ndone\n```\n### Passing IP address\n\nAll requests pass `X-Forwarded-For`, which is the client address. Each ApisCP panel installation **must be configured** to trust the cp-proxy server's data. Failure to do so will result in incorrect brute-force protection applied via [Anvil](../SECURITY.md#remote-access) or worse, IP spoofing by a malicious actor.\n\nOn all instances that accept traffic from cp-proxy **besides cp-proxy**, set *[core]* => *http_trusted_forward* assuming cp-proxy has the IP address 1.2.3.4:\n\n*`cp_proxy_ip` is a special setting in Bootstrapper that populates http_trusted_forward.*\n\n```bash\ncpcmd scope:set cp.bootstrapper cp_proxy_ip \"1.2.3.4\"\nenv BSARGS=\"--extra-vars=force=yes\" upcp -sb apnscp/bootstrap\n# Or alternatively\n# cpcmd scope:set cp.config core http_trusted_forward \"1.2.3.4\"\n#\n# Then in /usr/local/apnscp/config/httpd-custom.conf, add:\n#\n# LoadModule remoteip_module sys/httpd/modules/mod_remoteip.so\n# RemoteIPHeader X-Forwarded-For\n# RemoteIPTrustedProxy 1.2.3.4\n```\n\n**On the cp-proxy instance**, set http_trusted_forward to 127.0.0.1:\n\n```bash\ncpcmd scope:set cp.bootstrapper has_proxy_only true\ncpcmd scope:set cp.bootstrapper cp_proxy_ip 127.0.0.1\nenv BSARGS=\"--extra-vars=force=yes\" upcp -sb apnscp/bootstrap\n```\n\n:::warning cp-proxy as a solitary service\nSetting `http_trusted_forward` to 127.0.0.1 prevents spoofing from malicious actors when sending a bogus `X-Forwarded-For:` header. Setting `http_trusted_forward` to 1.2.3.4 without restricting public network access via `PrivateNetwork=yes` would allow an attacker to spoof their IP remotely from 1.2.3.4, or in other words allow a customer on your network to brute-force other machines. \n\nKeeping cp-proxy as a solitary service prevents such internal subterfuge.\n:::\n\n:::tip Improving security\nsystemd network isolation can be enabled to restrict intraserver communication to just the named services: mysql, postgresql, and cp-proxy. Set proxy_intraserver_only=true in Bootstrapper, then run env BSARGS=\"--extra-vars=force=yes\" upcp -sb apnscp/bootstrap. This makes an assumption that the API lookup does not reside on the same server ([auth] => server_query is different than local). If such a configuration were required, create a systemd override that adds httpd.service to JoinsNamespaceOf.\n:::\n\n### Billing compatibility\n\n[WHMCS module](https://github.com/lhdev/apiscp-whmcs) passes the active client IP address as `X-Forwarded-For` for firewall checks. When using cp-proxy in conjunction with supported billing modules, it is necessary to add the billing server to the list of trusted forwards. Specifying a list of IP addresses, ApisCP will filter internal and external addresses.\n\n```bash\n# Assuming WHMCS is installed on 64.22.68.2\ncpcmd scope:set cp.bootstrapper cp_proxy_ip '[127.0.0.1,64.22.68.2]'\nenv BSARGS=\"--extra-vars=force=yes\" upcp -sb apnscp/bootstrap\n```\n\n### Adding SSL\n\nIn the above example, the panel inherits the primary SSL certificate. This is managed by ApisCP. To add a new hostname, augment *[letsencrypt]* => *additional_certs*. It's easy to do using the cp.config Scope:\n```bash\ncpcmd scope:get cp.config letsencrypt additional_certs\n# Make a note of the certs, if any. Each certificate\n# is separated by a comma, e.g. \"mydomain.com,cp.mydomain.com\" or \"cp.mydomain.com\"\ncpcmd scope:set cp.config letsencrypt additional_certs \"mydomainalias.com,cp.mydomain.com\"\n```\nApisCP will automatically restart and attempt to acquire an SSL certificate for `cp.mydomain.com` in addition to the pre-existing SSL alias, `mydomainalias.com`.\n\n### cp-proxy configuration\n\nAll configuration is managed within `/etc/sysconfig/cp-proxy`. After making changes, activate the new configuration by restarting cp-proxy: `systemctl restart cp-proxy`.\n\n- **CP_TARGET**: initial URL that is fetched, this should be a panel login portal\n- **LISTEN_PORT**: port on which cp-proxy listens\n- **LISTEN_ADDRESS**: IPv4/6 address on which cp-proxy listens\n- **SECRET**: an alphanumeric salt used to encrypt session cookie. Generated randomly on service startup, which will expire existing sessions. Define this value if this behavior is undesired\n- **STRICT_SSL**: enable peer verification of hostnames when connecting via SSL\n\n### Multi-homed Hosts\nWhen working in situations in which a server is multi-homed, ensure each IP is bound to the panel. With ApisCP this can be accomplished by specifying multiple VHost macros in `/usr/local/apnscp/config/httpd-custom.conf`:\n```\nServerName myserver.com\nUse VHost 64.22.68.12\nUse VHost 64.22.68.13\n```\n\n### Different root domains\n\nProxy requires that all servers share the same root domain. For example, assuming proxy endpoint \"cp.mydomain.com\" and hosting servers,\n\n- svr1.mydomain.com\n- svr2.mydomain.com\n- svr3.mydomain.hosting\n\nBoth \"svr1\" and \"svr2\" would be valid names added to [cp-collector](https://github.com/apisnetworks/cp-collector). \"svr3\" would be invalid because the TLD (*.hosting*) differs.\n\nTo work around this, add each differing domain to /etc/hosts or create DNS records under mydomain.com. For example, in `/etc/hosts` this would suffice:\n\n```bash\necho \"$(dig +short svr3.mydomain.hosting) svr3.mydomain.hosting\" >> /etc/hosts\n```\n\n## Design\n\n### Server layout\n\nA caching HTTP accelerator like Varnish is recommended in front of the proxy to minimize requests that flow through to the proxy service. In my implementation, Apache sits in front for HTTP2 and TLS. Apache hits Varnish for static assets, then what is left flows to cp-proxy. cp-proxy serves from cp #1 by default.\n\n```\n +---------+\n +---> cp #1 |\n | +---------+\n+--------+ +---------+ +----------+ |\n| | | | | | | +---------+\n| apache +----> varnish +----> cp proxy +------> cp #2 |\n| | | | | | | +---------+\n+--------+ +---------+ +----------+ |\n | +---------+\n +---> cp #3 |\n +---------+\n```\n\n\n### Login mechanism & server designation\nA login should check if the account is resident on the server. If not resident, the request should be forwarded to the proper server as a 307 redirect issued. This `Location:` header is filtered from the response and its FQDN stored as a session cookie.\n\nEach subsequent request sends the session cookie that includes the server name to the proxy.\n\n### Bypassing reverse proxy\nAn application may include `no-proxy` header in its response. The Location will flow through in the response headers effectively allowing the session to break from the proxy. \n","has_starred","hub_user","anatolinicolae","immutable_tags_settings",{"_76":11,"_77":78},"enabled","rules",[79],".*","is_automated","permissions",{"_83":21,"_84":11,"_85":11},"read","write","admin","user","storage_size",349423669,"orgData",{"_91":92,"_93":94,"_95":96,"_97":33,"_98":33,"_99":100,"_101":33,"_102":103,"_104":105,"_106":107,"_108":48,"_109":48,"_110":21},"id","0e4e20b0eac244698888411ab5b72ac0","uuid","0e4e20b0-eac2-4469-8888-411ab5b72ac0","type","organization","orgname","full_name","location","Turin, IT","company","profile_url","https://thundersquared.com/","date_joined","2017-11-30T14:53:15.056719Z","gravatar_url","https://www.gravatar.com/avatar/27427420a8e50f38c866b77737df412e?s=80&r=g&d=mm","gravatar_email","badge","is_active","recentTags",[113,149],{"_114":44,"_115":116,"_117":118,"_91":119,"_120":121,"_50":138,"_139":116,"_140":73,"_141":56,"_57":142,"_143":144,"_145":129,"_146":138,"_147":66,"_148":21},"content_type","creator",1143859,"full_size",348782302,180698050,"images",[122],{"_123":124,"_125":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":118,"_63":66,"_137":-5},"architecture","amd64","digest","sha256:ce6e61e84ca618ec6e61710a3f18d2015f0eb9aa2683c8f3822b578c538f1fc7","features","last_pulled","2026-09-22T11:28:35.469313205Z","last_pushed","2021-12-04T21:53:15Z","os","linux","os_features","os_version","size","variant","2021-12-04T21:53:16.481443Z","last_updater","last_updater_username","media_type","latest","repository",15972397,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_114":44,"_115":116,"_117":118,"_91":150,"_120":151,"_50":153,"_139":116,"_140":73,"_141":56,"_57":154,"_143":144,"_145":129,"_146":153,"_147":66,"_148":21},180698046,[152],{"_123":124,"_125":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":118,"_63":66,"_137":-5},"2021-12-04T21:53:14.072941Z","1.0.0","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":168,"_175":176,"_162":189,"_190":11},{"_40":169,"_42":170,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":171,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":73,"_74":172,"_80":11,"_81":174,"_86":33,"_87":88},[],[44],[56],{"_76":11,"_77":173},[79],{"_83":21,"_84":11,"_85":11},"tags",{"_177":178,"_179":-5,"_180":-5,"_181":182},"count",2,"next","previous","results",[183,186],{"_114":44,"_115":116,"_117":118,"_91":119,"_120":184,"_50":138,"_139":116,"_140":73,"_141":56,"_57":142,"_143":144,"_145":129,"_146":138,"_147":66,"_148":21},[185],{"_123":124,"_125":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":118,"_63":66,"_137":-5},{"_114":44,"_115":116,"_117":118,"_91":150,"_120":187,"_50":153,"_139":116,"_140":73,"_141":56,"_57":154,"_143":144,"_145":129,"_146":153,"_147":66,"_148":21},[188],{"_123":124,"_125":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":118,"_63":66,"_137":-5},[],"canDeleteTags","actionData","errors"]

thundersquared/apiscp-cp-proxy

Tags for thundersquared/apiscp-cp-proxy