very hapy to see that a big part of my choices of continuous integration server around php was been solved by this blog (Ubuntu, git, phpundecontrol/cruisecontrol).

Very Good Job.

Thanks a lot.

very hapy to see that a big part of my choices of continuous integration server around php was been solved by this blog (Ubuntu, git, phpundecontrol/cruisecontrol).

Very Good Job.

Thanks a lot.

What I first did was restricting access to port 8000 just to the local IP via iptables. This should look somehow like this:

iptables -A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 8000 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 8000 -j REJECT --reject-with icmp-port-unreachable

Then, I created an extra DNS entry for a subdomain which handles the JMX console and modified my Apache config. I’m using GnuTLS for SSL-based virtual hosts here, but just letting it run without SSL should work fine too. With this config, the frontend is reachable via cruisecontrol.example.org and the console via jmx.cruisecontrol.example.org, both using the same authentication backend. The frontend vhost takes care of rewriting all requests to the JMX domain with some more output filter magic. Should more or less work copy&paste, just take care of the URLs in the output filters. My final config looks something like this:

<VirtualHost *:80>
        ServerName cruisecontrol.example.org
        RewriteEngine on
        RewriteRule ^(.*)$ https://cruisecontrol.example.org$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
    ServerName cruisecontrol.example.org

    [...SSL Stuff...]

    ProxyRequests Off  

    <Proxy *>
        Order deny,allow
        Allow from all

        AuthName        "CruiseControl"
        AuthType        Basic
        AuthUserFile    /etc/apache2/cruisecontrol.htpasswd
        require         valid-user
    </Proxy>  

    ProxyPass / http://127.0.0.1:8080/cruisecontrol/
    ProxyPassReverse / http://127.0.0.1:8080/cruisecontrol/

    ExtFilterDefine proxyurl mode=output intype=text/html cmd="/bin/sed s%http://127.0.0.1:8080%https://cruisecontrol.example.org%g"
    ExtFilterDefine proxypathfix mode=output intype=text/html cmd="/bin/sed s%/cruisecontrol/%/%g"
    ExtFilterDefine jmxurl mode=output intype=text/html cmd="/bin/sed s%http://cruisecontrol.example.org:8000%https://jmx.cruisecontrol.example.org%g"
    ExtFilterDefine ipfix mode=output intype=text/html cmd="/bin/sed s%127.0.0.1%cruisecontrol.example.org%g"

    SetOutputFilter proxyurl;proxypathfix;jmxurl;ipfix
</VirtualHost>

<VirtualHost *:80>
        ServerName jmx.cruisecontrol.example.org
        RewriteEngine on
        RewriteRule ^(.*)$ https://jmx.cruisecontrol.example.org$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
    ServerName jmx.cruisecontrol.example.org

    [...SSL Stuff...]

    ProxyRequests Off  

    <Proxy *>
        Order deny,allow
        Allow from all

        AuthName        "CruiseControl"
        AuthType        Basic
        AuthUserFile    /etc/apache2/cruisecontrol.htpasswd
        require         valid-user
    </Proxy>  

    ProxyPass / http://127.0.0.1:8000/
    ProxyPassReverse / http://127.0.0.1:8000/
</VirtualHost>

Regards,
Mathias

What I first did was restricting access to port 8000 just to the local IP via iptables. This should look somehow like this:

iptables -A INPUT -s 127.0.0.1/32 -p tcp -m tcp –dport 8000 -j ACCEPT
iptables -A INPUT -p tcp -m tcp –dport 8000 -j REJECT –reject-with icmp-port-unreachable

Then, I created an extra DNS entry for a subdomain which handles the JMX console and modified my Apache config. I’m using GnuTLS for SSL-based virtual hosts here, but just letting it run without SSL should work fine too. With this config, the frontend is reachable via cruisecontrol.example.org and the console via jmx.cruisecontrol.example.org, both using the same authentication backend. The frontend vhost takes care of rewriting all requests to the JMX domain with some more output filter magic. Should more or less work copy&paste, just take care of the URLs in the output filters. My final config looks something like this:

<VirtualHost *:80>
ServerName cruisecontrol.example.org
RewriteEngine on
RewriteRule ^(.*)$ https://cruisecontrol.example.org$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
ServerName cruisecontrol.example.org

[...SSL Stuff...]

ProxyRequests Off

<Proxy *>
Order deny,allow
Allow from all

AuthName “CruiseControl”
AuthType Basic
AuthUserFile /etc/apache2/cruisecontrol.htpasswd
require valid-user
</Proxy>

ProxyPass / http://127.0.0.1:8080/cruisecontrol/
ProxyPassReverse / http://127.0.0.1:8080/cruisecontrol/

ExtFilterDefine proxyurl mode=output intype=text/html cmd=”/bin/sed s%http://127.0.0.1:8080%https://cruisecontrol.example.org%g”
ExtFilterDefine proxypathfix mode=output intype=text/html cmd=”/bin/sed s%/cruisecontrol/%/%g”
ExtFilterDefine jmxurl mode=output intype=text/html cmd=”/bin/sed s%http://cruisecontrol.example.org:8000%https://jmx.cruisecontrol.example.org%g”
ExtFilterDefine ipfix mode=output intype=text/html cmd=”/bin/sed s%127.0.0.1%cruisecontrol.example.org%g”

SetOutputFilter proxyurl;proxypathfix;jmxurl;ipfix
</VirtualHost>

<VirtualHost *:80>
ServerName jmx.cruisecontrol.example.org
RewriteEngine on
RewriteRule ^(.*)$ https://jmx.cruisecontrol.example.org$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
ServerName jmx.cruisecontrol.example.org

[...SSL Stuff...]

ProxyRequests Off

<Proxy *>
Order deny,allow
Allow from all

AuthName “CruiseControl”
AuthType Basic
AuthUserFile /etc/apache2/cruisecontrol.htpasswd
require valid-user
</Proxy>

ProxyPass / http://127.0.0.1:8000/
ProxyPassReverse / http://127.0.0.1:8000/
</VirtualHost>

Regards,
Mathias

Thanks so much for taking the time on this post!

Thanks so much for taking the time on this post!