Proxies and Acquia Cloud

Issue

What proxy capabilities are available on Acquia Cloud?

Resolution

Complex websites are often handled by multiple web servers, all containing the same code. Sometimes, however, it can be necessary to split a website into multiple applications, all served from the same domain. For example, one application might serve www.example.com, but a special blogging tool is needed for www.example.com/blogs.

Because the DNS for www.example.com has to point to a single place, you might simply create a directory named /blogs. This is not always possible, however — the main website's technology and the blog's technology may not be able to coexist on the same server, or perhaps different people need access to control the applications, and they need to be physically separated due to internal compliance regulations.

The primary way of handling multiple, separate websites served under a single domain is by using some form of proxy server, which is usually another server that handles requests from resources on servers by clients.

In the previous example, a specific type of proxy server (a reverse proxy server) is needed to bring the main website and the blog into the same URL-space. The reverse proxy server appears to visitors as a normal web server, and sends requests for different hosted items to the appropriate server. For more information about reverse proxy servers, see the Apache's mod_proxy documentation .

Acquia Cloud uses several types of reverse proxy servers: Varnish provides caching for a slower back-end server, and Nginx balances load among several back-end servers.

There are several ways to set up a reverse proxy server to bring several servers into the same URL space

Use a CDN

Another option to consider is a content delivery network (CDN). A CDN may be better when a non-hosted website is struggling and holding open connections from Varnish. This can impact the ability for Acquia-hosted websites to be served, as well as other websites on the proxy configuration. By directing traffic at the CDN level, you can prevent performance issues.

A CDN can also be an easy solution when performing a gradual migration from platform to platform. 

For more information, see Using a Content Delivery Network with Acquia Cloud.

Utilize Apache's mod_proxy configurations

Acquia provides the ability to use Apache's mod_proxy module , which can be set up with a custom mod_proxy configuration. However, using a custom configuration means that any changes will need to go through a more structured review process. You can also use mod_rewrite rules in your .htaccess file with the [P] or proxy flag. This is the simplest method of setting up a proxy, and keeps any necessary changes in your hands. Customers should contact Support to enable the generic mod_proxy configuration.

To simply map one URL to another address, use the [P] flag in your .htaccess file.  The following code example is from the Apache 2.4 proxy guide. For more information about the [P] flag, see Introduction to htaccess rewrite rules.

#Reference: https://httpd.apache.org/docs/current/rewrite/proxy.html

RewriteEngine  on
RewriteCond %{ENV:AH_NON_PRODUCTION} 1
RewriteCond %{REQUEST_URI} ^/widget/ [NC]
RewriteRule "^products/widget/(.*)" "http://product.example.com/widget/$1" [L,P]

In the past we have recommended ProxyPassReverse rather than RewriteRule method. At this time, using the ProxyPassReverse method will cause the following error in the logs:

/var/www/html/DOCROOTENV/docroot/.htaccess: ProxyPassReverse not allowed here

This example proxies the request, only if the file or other resource cannot be found locally. This can be handy if you are migrating content from one sever to another, and you are unsure if all of the content has been migrated yet: 

RewriteCond "%{REQUEST_FILENAME}"       !-f
RewriteCond "%{REQUEST_FILENAME}"       !-d
RewriteRule "^/(.*)" "http://old.example.com/$1" [P]
ProxyPassReverse "/" "http://old.example.com/"

We have found that in Ubuntu Xenial, the DirectoryIndex can sometimes be applied to proxy requests [P], which can lead to unexpected behavior.  We've found that adding the following to the site's .htaccess file will resolve the problem

# ACQUIA: CL-17664: Apache 2.4 (in Xenial) changes how mod_rewrite handles
# proxy requests ([P]), and DirectoryIndex ends up getting inappropriately
# applied to them. This setting mirrors 2.2 behavior:
DirectoryCheckHandler On

Note that since a proxy consumes threads from the allotted connections in Apache, there is a risk the available pool can become overwhelmed in the case where the web service being proxied to is slow or unavailable. This external service dependency can negatively impact your Acquia hosted sites. 

Maintain specialized proxy servers outside of Acquia Cloud

Running a customized proxy server, such as an F5 appliance or similar, is outside the scope of Acquia's support or advice. If you use this method, you will need the proper staff and capacity to manage this appliance. If you're not already running a customized proxy server, setting one up can be considered a major investment.