How can I use Confluence on a subdomain
Asked by Nicolas Rehner:

Hello community,

as mentioned above I'm trying to make my confluence server accessible by typing "<https://sub.domain.tld>" in my browser bar.

I googled a lot, searched the community \& the Atlassian documentation - but I'm still far from getting it to work. So I hope someone can "take me by the hand" or at least point me at my mistakes to get it running.

So here's an overview on my environment and the steps I took:

* Server
  * Hoster: Strato (DE)
  * OS: Ubuntu 16.04.3 LTS
  * Plesk Onyx 17.5.3
  * Confluence 6.6.2
  * Apache 2.4.18
  * Subdomain certified trough Let's encrypt (Plesk)
* Status quo
  * Confluence accessible with "<http://sub.domain.tld:8090>"
  * Confluence **not** accessible with "<https://sub.domain.tld:8090>" (Error: SSL_ERROR_RX_RECORD_TOO_LONG)
  * Confluence **not** accessible with "<https://sub.domain.tld>" (no Error but points to document root from Plesk)
  * Confluence **not** accessible with "<http://sub.domain.tld>" (points to document root from Plesk)
* What I did so far
  * Created an 'vhost.conf' located at /var/www/vhosts/system/sub.domain.tld/conf wich contains:

```
<VirtualHost XXX.XXX.XXX.XXX:7080>
ServerName sub.domain.tld 
ProxyRequests Off
ProxyPreserveHost On 
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/synchrony
RewriteRule ^/(.*) http://sub.domain.tld:8090/$1 [P] 
<Proxy *> 
Require all granted 
</Proxy> 
ProxyPass /synchrony http://sub.domain.tld:8091/synchrony 
<Location /synchrony> 
Require all granted 
RewriteEngine on 
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC] RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
RewriteRule .* ws://sub.domain.tld:8091%{REQUEST_URI} [P] 
</Location> 
ProxyPass / http://sub.domain.tld:8090 
ProxyPassReverse / http://sub.domain.tld:8090 
<Location /> 
Require all granted 
</Location> 
</VirtualHost> 
```

XXX.XXX.XXX.XXX = Ip of my server / sub.domain.tld = my subdomain

* Guides I used
  * <https://rachny.eu/display/STAR/Speedrun+Installation+Atlassian+Confluence+unter+Strato+Plesk+Odin> (German)
  * <https://community.atlassian.com/t5/Confluence-questions/Get-Confluence-working-on-a-subdomain/qaq-p/624173>
  * <https://confluence.atlassian.com/doc/using-apache-with-mod_proxy-173669.html>

It would be create if you can help me out and point me to my mistakes!

Regards Nic


Answers:
author: Panos
body: * Confluence **not** accessible with "[https://sub.domain.tld:8090](https://sub.domain.tld:8090/)" (Error: SSL_ERROR_RX_RECORD_TOO_LONG)  

  That's right. SSL is on the apache and is best used there.

Since you are proxying the confluence, meaning that you should also declare this to the server.xml. Append to the \<Connector section:

    proxyName="https://sub.domain.tld:8090/"proxyPort="80"scheme="http"

As above poster, and without much knowledge of plesk, you are exposing port 7080 but you are expecting to connect to 443.


author: Edwin Kyalangalilwa
body: Hi Nicolas,

Try changing to (reason there is error: SSL_ERROR_RX_RECORD_TOO_LONG)

```
<VirtualHost _default_:80>
```

This will forward [http://sub.domain.tld](https://sub.domain.tld/) to ProxyPass [http://sub.domain.tld:8090](http://sub.domain.tld:8090 "http://sub.domain.tld:8090")

For SSL, you'll have to forward 80 to [https://sub.domain.tld](https://sub.domain.tld/) and create

```
<VirtualHost _default_:443>
```

to forward 443 to [http://sub.domain.tld:8090](http://sub.domain.tld:8090 "http://sub.domain.tld:8090")

More examples here <https://community.atlassian.com/t5/Jira-questions/Jira-with-https-using-apache/qaq-p/706209>


author: TV Clipz
body: What if your using centos7 64 bit with cPanel using nginx and want to use auto SSL that cPanel issues  
I want to remove access to ip: xxx.xxx.xx.x:8090  
And change it to  
<https://docs.domain.com>  

What would be the best easiest way ?  
Thanks I'm new to all this and a little confused. Totally appreciate any help .

comments: author: TV Clipz
body: im all set had a friend fix this for me


author: abobakr
body: Appreciate if you could explain the details here so others could benefit from.

I am looking for instruction on how to install Jira, Confluence and bitbucket on Cpanel server.


author: Nicolas Rehner
body: [@Edwin Kyalangalilwa](/t5/user/viewprofilepage/user-id/255918) \& [@Panos](/t5/user/viewprofilepage/user-id/853254)

Thanks for your hints! Tested them along with some more googled - but it just didn't work. By chance I found out that the content of my 'vhost.conf' (mentioned above) is displayed in Plesk under

**Subscriptions -\> Websites\&Domains -\> \<your.domain\> -\> Apache \& nginx Settings -\> Additional directives for HTTP**.

There's also a section for **Additional directives for HTTPS**wich was empty.

So I pasted the Code from HTTP to HTTPS and tried to save. Plesk gave me an Error pointing out that \<VirtualHost XXX.XXX.XXX.XXX:80\> is not allowed in this directive. (I didn't get the Error earlier because I edited the code in 'vhost.conf' directly) -  
what should I say, after removing the incipient and the concluding \<VirtualHost XXX.XXX.XXX.XXX:80\> code in both directives my instance is finally reachable under '<https://sub.domain.tld>'.

So this problem is solved - but I ran in a new one:

Whenever using the editor sooner or later I get the Error described [in this KNB Article](https://confluence.atlassian.com/confkb/confluence-throws-the-editor-didn-t-load-this-time-error-when-trying-to-edit-a-page-840796639.html). As I understand using a reverse proxy could cause this.

Does anyone see a mistake in the ProxyPass /synchrony part of my directive?

comments: author: Nicolas Rehner
body: In the mentioned KNB Article there's a diagnostic step that recommends to visit <http://websocket.org/echo.html> to test the ability to establish a websocket connection.  
They provide html code to perform your own tests.  
I made an html document out of it wich I uploaded to the web root on my server.

When I try to access it the server returns a '403 Forbidden' Error.  
(When opening it locally it works properly)

Does this hint to an firewall rule on the server that prevents synchrony to work proper?


author: Panos
body: How are you accessing the synchrony from internet? You should use yourdomain/synchrony and not yourdomain:8091


author: Nicolas Rehner
body: You mean through the browser? Never tried this actually - only used it inside confluence.

In my apache conf I use this part of the directive:

```
<Proxy *>
 Require all granted
</Proxy>

ProxyPass /synchrony http://sub.domain.tld:8091/synchrony

<Location /synchrony>
 Require all granted
 RewriteEngine on
 RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
 RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
 RewriteRule .* ws://sub.domain.tld:8091%{REQUEST_URI} [P]
</Location>
```


author: Nicolas Rehner
body: When trying to access '<https://sub.domain.tld/synchrony>' I get

```
{"message":"Not Found"}

diplayed.
```


author: Panos
body: Probably i misunderstood what you wrote apologies. Taking a second look in your configuration, it seems that you are not proxying the /synchrony rather round it to the sub.domain.tld:8091 which should not be open.

Do not open 8091, change the settings to proxy the /synchrony:

```
ProxyPass /synchrony http://localhost:8091/synchrony
```

```
<Location /synchrony>
 Require all granted
 RewriteEngine on
 RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
 RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
 RewriteRule .* ws://localhost:8091%{REQUEST_URI} [P]
</Location>
```


author: Nicolas Rehner
body: No matter - thanks for your quick help primarily!

I applied the changes but the behavior stays the same.

Does it make sense to use

```
RewriteRule .* wss://localhost:8091%{REQUEST_URI} [P]
```

instead of

```
RewriteRule .* ws://localhost:8091%{REQUEST_URI} [P]
```

due to the use of https?


author: Panos
body: Did you also change the ProxyPass?

<br />

No, your tomcat server is not having any SSL. wss would break even more.

Check that you have

```
LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.soLoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.soLoadModule proxy_wstunnel_module /usr/lib/apache2/modules/mod_proxy_wstunnel.soLoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so
```

modules enabled. Location may varies. If you have selinux set permissive temporary and start scavenging logs for the 403 error.


author: Nicolas Rehner
body: Yes I applied both changes you suggested.

The modules are activated trough Plesk - but I'll dig in the system to find my LoadModule Directives.

selinux is not present on my server and I'm not familiar with it so I'm a bit afraid activating it.

Are there any other ways to find significant logs?

Edit: Could this guide help me any further? <https://confluence.atlassian.com/confkb/how-to-configure-apache-mod_jk-to-proxy-confluence-6-x-or-later-867351565.html>

mod_jk is enabled but I'm not sure if used to proxy confluence


author: Panos
body: I am not a plesk expert, you should check though apache logs for why the 403 and atlassian-confluence.log along with synchrony.log in the application-data folder.

(Names are indicative, can't remember exact filenames)


author: Nicolas Rehner
body: Can you give me hints what to search for in synchrony.log?


author: Panos
body: Sorry no, i use older version of confluence myself. Anyhow, something indicative of permission denied.


author: Nicolas Rehner
body: Thanks for your help!

Because it doesn't really correspondend to the original question I started a new one for this problem.

It can be found here: <https://community.atlassian.com/t5/Confluence-questions/How-can-I-get-Synchrony-to-work-behind-a-reverse-Proxy/qaq-p/715495>


Tags: apache

ssl

subdomain