# Apache2 reverse proxy vaultwarden dietpi-dashboard
**URL:** https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597
**Category:** Troubleshooting
**Created:** [7 December 2023 07:31 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597 "2023-12-07T07:31:13Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@gitzjoey](https://dietpi.com/forum/u/gitzjoey)
#### Post date: [7 December 2023 07:31 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/1 "2023-12-07T07:31:13Z")
Hi,
so basically i want to reduce opening random port by creating some reverse proxy
[https://DietPi:5252](https://DietPi:5252) to [https://dietpi-dashboard](https://dietpi-dashboard).[domain].[com]
[https://DietPi:8001](https://DietPi:8001) to [https://dietpi-dashboard](https://dietpi-dashboard).[domain].[com]
can someone provide example of apache2 sites-available conf for this 2 (dietpi-dashboard and vaultwarden) ?
---
### Author:  [@Joulinar](https://dietpi.com/forum/u/Joulinar)
#### Post date: [7 December 2023 07:48 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/2 "2023-12-07T07:48:09Z")
> **[Proxy examples](https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples)**
>
> Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden\_rs - dani-garcia/vaultwarden
---
### Author:  [@gitzjoey](https://dietpi.com/forum/u/gitzjoey)
#### Post date: [7 December 2023 07:52 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/3 "2023-12-07T07:52:48Z")
hi @Joulinar
yes i’ve read that and tried to use the setup, but this is the best i get
```auto
ServerAdmin admin@gitzjoey.online
ServerName vault.gitzjoey.online
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
RewriteEngine on
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /notifications/hub(.*) ws://DietPi:3012/$1 [P,L]
ProxyPass / https://DietPi:8001/
ProxyPreserveHost On
ProxyRequests Off
RequestHeader set X-Real-IP %{REMOTE_ADDR}s
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/gitzjoey.online/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/gitzjoey.online/privkey.pem
```
but i get this error in journalctl
```auto
Dec 07 19:35:14 DietPi apache2[12648]: [ssl:warn] [pid 12648:tid 281473458769952] AH01909: vault.gitzjoey.online:443:0 server certificate does NOT include an ID which matches the server name
Dec 07 19:35:36 DietPi apache2[18924]: [core:error] [pid 18924:tid 281472906367264] [remote 127.0.1.1:8001] AH01961: failed to enable ssl support [Hint: if using mod_ssl, see SSLProxyEngine]
Dec 07 19:35:36 DietPi apache2[18924]: [proxy:error] [pid 18924:tid 281472906367264] AH00961: https: failed to enable ssl support for 127.0.1.1:8001 (dietpi)
Dec 07 19:35:36 DietPi vaultwarden[4063]: [2023-12-07 19:35:36.503][rocket_http::tls::listener][WARN] tls handshake with 127.0.0.1:51250 failed: tls handshake eof
Dec 07 19:35:36 DietPi apache2[18924]: [core:error] [pid 18924:tid 281473438978336] [remote 127.0.1.1:8001] AH01961: failed to enable ssl support [Hint: if using mod_ssl, see SSLProxyEngine]
Dec 07 19:35:36 DietPi apache2[18924]: [proxy:error] [pid 18924:tid 281473438978336] AH00961: https: failed to enable ssl support for 127.0.1.1:8001 (dietpi)
Dec 07 19:35:36 DietPi vaultwarden[4063]: [2023-12-07 19:35:36.624][rocket_http::tls::listener][WARN] tls handshake with 127.0.0.1:51264 failed: tls handshake eof
```
---
### Author:  [@gitzjoey](https://dietpi.com/forum/u/gitzjoey)
#### Post date: [9 December 2023 05:28 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/4 "2023-12-09T05:28:26Z")
I’ve change the config into
```auto
SSLEngine on
ServerName vault.gitzjoey.online
SSLCertificateFile /etc/letsencrypt/live/gitzjoey.online/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/gitzjoey.online/privkey.pem
ErrorLog /var/log/apache2/vaultwarden-error.log
CustomLog /var/log/apache2/vaultwarden-access.log combined
ProxyPass / https://DietPi:8001/ upgrade=websocket
ProxyPreserveHost On
ProxyRequests Off
RequestHeader set X-Real-IP %{REMOTE_ADDR}s
# Add this line if your url attributes are reported back as http://... :
RequestHeader add X-Forwarded-Proto https
```
but having issue with Rocket webservice
in journalctl
`[2023-12-09 13:24:24.718][rocket_http::tls::listener][WARN] tls handshake with 127.0.0.1:56740 failed: tls handshake eof`
---
### Author:  [@Joulinar](https://dietpi.com/forum/u/Joulinar)
#### Post date: [9 December 2023 11:34 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/5 "2023-12-09T11:34:18Z")
Better to disable SSL within vaultwarden, as HTTPS is done by the reverse proxy now. There are a couple of descriptions within the forum how to do it.
---
### Author:  [@gitzjoey](https://dietpi.com/forum/u/gitzjoey)
#### Post date: [9 December 2023 12:03 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/6 "2023-12-09T12:03:41Z")
```auto
SSLEngine on
ServerName vault.gitzjoey.online
SSLCertificateFile /etc/letsencrypt/live/gitzjoey.online/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/gitzjoey.online/privkey.pem
ErrorLog /var/log/apache2/vaultwarden-error.log
CustomLog /var/log/apache2/vaultwarden-access.log combined
ProxyPass / http://DietPi:8001/ upgrade=websocket
ProxyPreserveHost On
ProxyRequests Off
RequestHeader set X-Real-IP %{REMOTE_ADDR}s
# Add this line if your url attributes are reported back as http://... :
RequestHeader add X-Forwarded-Proto https
```
replacing the [https://DietPi](https://DietPi) into [http://DietPi](http://DietPi)
but the rocket error keep coming, honestly not really understand about websocket in vaultwarden
```auto
vaultwarden[72386]: [2023-12-09 20:01:47.386][rocket_http::tls::listener][WARN] tls handshake with 127.0.0.1:44546 failed: received corrupt message of type InvalidContentType
```
BTW, I just crawling into DietPi-Dashboard github issues, also find some threads from @MichaIng about adding reverse-proxy ability into it
\*\*update
just realize its stated in docs, that i need to disable rocket websocket when using reverse proxy
```auto
he examples below assume you are running in this configuration, in which case you should not enable the HTTPS functionality built into Vaultwarden (i.e., you should not set the ROCKET_TLS environment variable). If you do, connections will fail since the reverse proxy is using HTTP to connect to Vaultwarden, but you're configuring Vaultwarden to expect HTTPS.
```
---
### Author:  [@Joulinar](https://dietpi.com/forum/u/Joulinar)
#### Post date: [9 December 2023 12:58 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/7 "2023-12-09T12:58:22Z")
As stated above already, you need to disable SSL within vaultwaden configuration. We have a couple of examples for different web server in our forum. Including a step by step guide.
---
### Author:  [@gitzjoey](https://dietpi.com/forum/u/gitzjoey)
#### Post date: [9 December 2023 14:09 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/8 "2023-12-09T14:09:44Z")
appreciate if you can share some url/link about the step by step guide (specially for apache2)
---
### Author:  [@gitzjoey](https://dietpi.com/forum/u/gitzjoey)
#### Post date: [9 December 2023 14:24 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/9 "2023-12-09T14:24:59Z")
anyway i’ve succeed
sharing the config, for others if interested
```auto
SSLEngine on
ServerName vault.gitzjoey.online
SSLCertificateFile /etc/letsencrypt/live/gitzjoey.online/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/gitzjoey.online/privkey.pem
ErrorLog /var/log/apache2/vaultwarden-error.log
CustomLog /var/log/apache2/vaultwarden-access.log combined
ProxyPass / http://localhost:8000/ upgrade=websocket
ProxyPreserveHost On
ProxyRequests Off
RequestHeader set X-Real-IP %{REMOTE_ADDR}s
# Add this line if your url attributes are reported back as http://... :
#RequestHeader add X-Forwarded-Proto https
```
the important thing is to remarks all ROCKET websockets in vaultwarden.conf
---
### Author:  [@Joulinar](https://dietpi.com/forum/u/Joulinar)
#### Post date: [9 December 2023 18:19 UTC](https://dietpi.com/forum/t/apache2-reverse-proxy-vaultwarden-dietpi-dashboard/18597/10 "2023-12-09T18:19:06Z")
> [@gitzjoey](#):
>
> url/link about the step by step guide
> [@Confused Reverse proxy and vaultwarden](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/21):
>
> of course you can use docker and container like NginxProxyManager or traefik but it’s working without as well. I did a test installation on 2 RPi. I used 2 devices just for testing. It’s fine to host web server as well as vaultwarden on a single device. created a DDNS domain from a free provider activate regular DDNS update using dietpi-ddns RPi 1 is hosting web server lighttpd RPi 2 is hosting vaultwarden on RPi 2 I was going to disable HTTPS on vaultwarden nano /mnt/dietpi\_userdata/vaultwa…
Not for Apache but should be similar.