Using Apache2 HTTP Server as the Proxy Server

Any preferred server can be used as a proxy server between the device and the WSO2 IoT server. The steps documented below is only an example of configuring the proxy server by using the Apache2 HTTP Server. The Apache Server can be configured using the forward or reverse proxy (also known as gateway) mode. The reverse proxy mode is used to configure Apache2. You can download the Apache2 HTTP Server from here.

Follow the steps given below to configure the proxy Server:

Step 1: Configure reverse proxy

A reverse proxy (or gateway) appears to the client like an ordinary web server with no special configuration required for the client. Ordinary requests for content is made by the client through the name-space. The reverse proxy redirects the requests, and returns the required output.

The following modules are required to configure the reverse proxy:

mod_proxy.so
This module deals with proxying in Apache.
mod_proxy_http.soThis module handles connections with both the HTTP and HTTPS protocols.

Navigate to the etc/apache2 directory and use the following command to enable the above modules:
```
cd /etc/apache2
a2enmod proxy_http
```

Configure the proxy.conf file that is in the /etc/apache2/mods-available directory by including the configurations given below to the end of the file.

ServerName localhost
ProxyRequests off
ProxyPreserveHost off
  <Proxy *>
  Order deny,allow
  #Deny from all
  Allow from all    
  </Proxy>
ProxyPass /ENROLLMENTSERVER/PolicyEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/certificatepolicy/xcep
ProxyPassReverse /ENROLLMENTSERVER/PolicyEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/certificatepolicy/xcep

ProxyPass /ENROLLMENTSERVER/DeviceEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/deviceenrolment/wstep
ProxyPassReverse /ENROLLMENTSERVER/DeviceEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/deviceenrolment/wstep

ProxyPass /Syncml/initialquery http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/syncml/devicemanagement/request
ProxyPassReverse /Syncml/initialquery http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/syncml/devicemanagement/request
 
ProxyPass /ENROLLMENTSERVER/Win10DeviceEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/deviceenrolment/enrollment
ProxyPassReverse /ENROLLMENTSERVER/Win10DeviceEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/deviceenrolment/enrollment

ProxyPass /devicemgt  http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/management/devicemgt/pending-operations
ProxyPassReverse /devicemgt  http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/management/devicemgt/pending-operations
 
ProxyPass /windows-web-agent http://server-ip>:<server-port>/windows-web-agent
ProxyPassReverse /windows-web-agent http://server-ip>:<server-port>/windows-web-agent

The default <server-ip>:<server-port> is localhost:9443.

Step 2: Configure the Rewrite engine

The first GET and POST HTTP requests are received by the same MDM endpoint and the rewrite conditions filter the device requests. By default the Apache Rewrite engine is disabled.

Follow the steps given below to enable the Rewrite engine when running on Ubuntu:

Invoke the rewrite rules:
1. Create a .htaccess file in the /var/www/ directory with the specific rewrite rules.
2. Enable the mod_rewrite module.
```
sudo a2enmod rewrite
```
Configure the 000-default file, which is in the /etc/apache2/sites-enabled directory.

This step is required to replicate the configuration changes required in the Apache versions on a few files.In the older Apache versions, all virtual host directory directives were managed in the apache2.conf file, which is in the /etc/apache2 directory. In the Apache 2.4.7 version this has changed and the alterations are handled within the /etc/apache2/sites-enabled directory.
1. Configure the value assigned to AllowOveride from None to All under <Directory/>.
```
AllowOverride All
```
2. Configure the content under <Directory /var/www/>.
  
  If the 000-default file does not contain the Directory tag you need to add it to the file as shown below:
```
<Directory /var/www/>
 Options Indexes FollowSymLinks MultiViews
 AllowOverride all
 Order allow,deny
 allow from all
</Directory>
```
Restart the Apache server.
```
server.sudo service apache2 restart
```

Click here to see the Rewrite Engine Configuration file format

Rewrite Engine Configuration file format

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(GET)$
RewriteRule /EnrollmentServer/Discovery.svc   http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/discovery/get [P,L]

RewriteCond %{REQUEST_METHOD} ^(POST)$
RewriteRule /EnrollmentServer/Discovery.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/discovery/post [P,L]

The default <server-ip>:<server-port> is localhost:9443.

Step 3: SSL configurations for Apache2

An SSL certificate is used to encrypt the information of a site and create a secure connection.

Follow the steps given below to configure SSL for Apache2:

SSL support is available as a standard on the Ubuntu 14.04 Apache package.

Enable the SSL Module.
```
sudo a2enmod ssl
```
Create a subdirectory named ssl within the Apache server configuration hierarchy to place the certificate files.
```
sudo mkdir /etc/apache2/ssl
```
The WSO2 IoTS certificate must be generated from a trusted authority.

Once you have the WSO2 IoT certificate and key available, configure the Apache server to use these files in a virtual host file. For more information, see how to set up Apache virtual hosts.

Configure the default-ssl.conf file, which is in the /etc/apache2/sites-enabled directory contains the default SSL configurations.

SSLEngine on
SSLCertificateFile    /etc/apache2/ssl/<COMAPNY_CERTIFICATE>
SSLCertificateKeyFile /etc/apache2/ssl/<COMPANY_PUBLIC_KEY>
SSLCACertificateFile /etc/apache2/ssl/<COMPANY_ROOT_CERTIFICATE>

Example:

SSLEngine on
SSLCertificateFile    /etc/apache2/ssl/star_wso2_com.crt
SSLCertificateKeyFile /etc/apache2/ssl/star_wso2_com.key
SSLCACertificateFile /etc/apache2/ssl/DigiCertCA.crt

Enable the SSL-enabled virtual host that you configured in the above step.
```
sudo a2ensite default-ssl.conf
```
Restart the Apache server to load the new virtual host file.
```
sudo service apache2 restart
```