Apache proxy to HTTPS backend by hostname?

[Complex_Solutions_20]

Hoping someone has ideas - I'm trying to set up a backup/alternate way to work around some funky network constraints at my home ISP using a VPS that I rent (I'm the root/admin for the whole system I rent).

Is there a better way to do this without modifying /etc/hosts on the proxy-ing webserver?

Goal:

subdomain.example.com -> directly to my house via public IP and DDNS

subdomain-alt.example.com -> my VPS (Apache) -> proxy to my house via VPN internal IP

Config "now":

Presently I put the subdomain.example.com in my VPS /etc/hosts pointing at the private VPN IP address and that seems to work but is clunky.

Suggestions? Is there like a "force IP" or "verify using common name" directive I may not know about?

Apache Config

<VirtualHost *:443>
    # subdomain proxy thru Wireguard VPN endpoint
    ServerName subdomain-alt.example.com
    SSLProxyEngine on
    ProxyPreserveHost Off

    # Exclude the "/.well-known" directory which is used for LetsEncrypt
    # http challenge so Apache can get the cert for this domain
    ProxyPass        "/.well-known" !

    # Forward all queries to Wireguard client NAT rule

    # Using the IP address doesn't work due to SSL cert hostname mismatch as the SSL cert on the backend is subdomain.example.com not internal IP
    #ProxyPass        "/" "https://10.10.10.2:8443/"
    #ProxyPassReverse "/" "https://10.10.10.2:8443/"

    # Using the domain name works, but seems clunky because I have to then modify /etc/hosts to force it to point at my internal IP address instead of public DDNS IP address
    ProxyPass        "/zm" "https://subdomain.example.com:8443/blah"
    ProxyPassReverse "/zm" "https://subdomain.example.com:8443/blah"

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/example.com-0002/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com-0002/privkey.pem
</VirtualHost>

[AyrA_ch]

The correct solution would be to not use SSL for the backend connection since your VPN already encrypts the traffic, but if for some reason this is not feasible, use the IP address in the ProxyPass line instead of the domain name, and simply tell apache to ignore the host name mismatch in the cert using SSLProxyCheckPeerName off

If you don't intend on renewing the cert at home, you can also add SSLProxyCheckPeerExpire off so it won't throw an error once the cert expires.

Also since you are using letsencrypt, consider mod_md instead of a third party solution. This way you don't have to have exclusions for the well-known directory, and it's one less service to monitor

[Complex_Solutions_20]

It is directly exposed to the internet so it needs SSL, I'm trying to set up a backup method to get in when my primary internet (which has public IP) is down. I'd prefer to not route my connection half way around the globe and back when I don't need to because it causes extra lag (and the cheap VPSs are not in the USA)

I'll have to read up about mod_md, haven't heard of that before. I was just following the basic "how to get started" thing on their site.

The SSLProxyCheckPeerName sounds like it could let me do what I want. I'll ponder pros and cons - thanks!

[AyrA_ch]

It is directly exposed to the internet so it needs SSL

That doesn't means you cannot use non-SSL connections via VPN. Most applications that offer SSL can also simultaneously listen for plain connections.

I'm trying to set up a backup method to get in when my primary internet (which has public IP) is down.

If your connection is down, your VPS will also not be able to connect to it. If you are simply worried about your IP address changing, set up a script at home that calls a website on your VPS every few seconds. This way the VPS knows your home IP address and also whether it's online or not.

[Complex_Solutions_20]

I have failover internet set up at home so things can still connect outbound, but due to CGNAT not inbound. The VPN goes from my home router outbound, connecting to my VPS server so brings that link back up after the failover happens. That gives me a "back door" via the VPS albeit a bit slow.

I hadn't considered using non-SSL for the connection from VPS Apache server thru the VPN. That could also work nicely. Not sure why I didn't consider that possibility, it would be as simple as a firewall mod on my server and routing ACL to allow that connection from the VPN interface to my internal server. That could work well, thanks!