Hello! My apologies, yes, I have received your reply, I’ve just been very busy this week and got caught up in work stuff. Here is what we will accomplish in the next step:
- Creating the Apache reverse proxy and VHOST configuration
- Configuring the Mattermost Configuration to become reverse proxied through Apache, and connect to the subdomain
- Generating a SSL certificate with Certbot and LetsEncrypt, to protect your Mattermost instance with HTTPS
These three steps are pretty much the end of the setup for Mattermost specifically, although I would be more than happy to assist in the reconfiguration of the setup of the other domains if desired so that they are more reliable as well.
Let’s get started:
Creating the Apache VHOST Configuration
- Open your command line, and change directory to the
/etc/httpd/conf.d directory:
cd /etc/httpd/conf.d/
- Create the configuration file:
sudo touch mat.invisiblenotes.com.conf
- Open the configuration file in your command-line text editor:
sudo nano mat.invisiblenotes.com.conf
- Copy the following code and paste it into the file by right-clicking your mouse on the command prompt window, if working over SSH, or by pasting the text into the file if you copied the code from a browser on the server itself. This is our VHOST HTTP Configuration:
<VirtualHost *:80>
#ServerName directive specifies the URL that the configuration listens for.
ServerName mat.invisiblenotes.com
#ServerAdmin specifies the email to be displayed on all error pages shown to users as
#the support email for the domain.
ServerAdmin hostmaster@mydomain.com
#Reverse proxy configuration for Mattermost WebSockets and HTTP/HTTPS requests.
ProxyPreserveHost On
# Set web sockets
RewriteEngine On
RewriteCond %{REQUEST_URI} /api/v[0-9]+/(users/)?websocket [NC,OR]
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
<Location />
Require all granted
ProxyPass http://127.0.0.1:8065/
ProxyPassReverse http://127.0.0.1:8065/
ProxyPassReverseCookieDomain 127.0.0.1 mat.invisiblenotes.com
</Location>
</VirtualHost>
Note: You should change the email address located in the line
"ServerAdmin hostmaster@mydomain.com" to a suitable support contact email, this email will be shown on all error pages that users potentially encounter. To disable this, simply change the line to "#ServerAdmin hostmaster@mydomain.com" minus the quotes.
-
To exit and save from the nano command-line editor, to exit from the editor, use CTRL+X, then select y when prompted if you want to save the file, and then hit enter(return) to save. At this point, you should be back to your command prompt now.
-
Next we will check the configuration for errors, and verify that the file is correctly setup and functional. If you receive anything other than the expected output, please do not continue with the rest of the steps, and instead reply with the error you receive, so that we can get it figured out 
Check your configuration files to make sure they are error-free by running the command:
sudo apachectl configtest
The expected output should be Syntax OK
If you see anything other than Syntax OK or there is anything else that you see returned in addition to Syntax OK, please send the information here, as it is better to be safe and make sure there are no errors than to risk breaking the server.
If you have successfully verified that the configuration is functional, we can now apply it by running the command sudo systemctl reload httpd
At this point, we have now configured the reverse proxy for the domain, however, we need to reconfigure our Mattermost settings to reflect the same values as Apache.
We need to make sure that the Mattermost settings are configured to use the correct domain name and listen on the internal IP and port so that the reverse proxy functions properly.
Here is how we can do this:
Note that the following steps are assuming that you have installed Mattermost to the recommended location, `/opt/mattermost`. If you have installed it in a different location, replace `/opt/mattermost` with your own file path.
cd /opt/mattermost/config/-
cp config.json config.json.bak (Create a backup of original configuration)
-
nano config.json
Now we need to change several values, and make sure they correspond to the Apache configuration.
- In the first section of the
config.json file, here is what we want it to look like:
"ServiceSettings": {
"SiteURL": "https://mat.invisiblenotes.com",
"WebsocketURL": "",
"LicenseFileLocation": "",
"ListenAddress": ":8065",
"ConnectionSecurity": "",
"TLSCertFile": "",
"TLSKeyFile": "",
"TLSMinVer": "1.2",
"TLSStrictTransport": false,
"TLSStrictTransportMaxAge": 63072000,
"TLSOverwriteCiphers": [],
"UseLetsEncrypt": false,
"LetsEncryptCertificateCacheFile": "./config/letsencrypt.cache",
"Forward80To443": false,
"TrustedProxyIPHeader": [
"X-Forwarded-For",
"X-Real-IP"
],
Once your configuration file reflects the same as above, save the file and exit the editor, and restart Mattermost with sudo systemctl restart mattermost
It may take a couple of seconds, but it should work. If you encounter any errors or it fails, please let us know, of course.
- Finally, we need to generate the HTTPS SSL certificate. From the command line, run the command
sudo certbot --apache and follow the prompts, providing information as requested to the program. When you are prompted to select a number for the domain, such as the following, select the number that is next to the domain. In the example provided, that would be 1.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: mat.invisiblenotes.com
2: example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Continue to provide information to the program, and make sure to ENABLE HTTPS redirect on successful generation of the certificate, this is one of the final questions CertBot will ask you.
If you encounter any errors with this step, please provide the full output, and error messages, so that we can get it figured out. If this goes without any issues, you can now navigate to https://mat.invisiblenotes.com and login to your Mattermost instance!
Please let me know if you have any questions, concerns, or if anything goes wrong!
