There are several options for public deployment of a web service. The
main decision is whether to run it on a standard port (port 80 for HTTP,
port 443 for HTTPS) or a non-standard port such as for example 8000 or
8080. Using a standard port below 1000 requires root access to the
machine, and prevents other web services from using the same port. On
the other hand, using a non-standard port may cause problems with
intermediate proxy- and/or firewall policies that may block the port
when you try to access the service from some networks. In both cases,
you can either use a physical or a virtual machine running ---for
example--- under VMWARE
or
XEN
to host the service. Using a dedicated (physical or virtual) machine to
host a service isolates security threats. Isolation can also be achieved
using a Unix chroot environment, which is however not a
security feature.
To make several different web services reachable on the same (either
standard or non-standard) port, you can use a so-called reverse
proxy. A reverse proxy uses rules to relay requests to other web
services that use their own dedicated ports. This approach has several
advantages:
- We can run the service on a non-standard port, but still access it
(via the proxy) on a standard port, just as for a dedicated machine. We
do not need a separate machine though: We only need to configure the
reverse proxy to relay requests to the intended target servers.
- As the main web server is doing the front-line service, the Prolog
server is normally protected from malformed HTTP requests that could
result in denial of service or otherwise compromise the server. In
addition, the main web server can transparently provide encodings such
as compression to the outside world.
Proxy technology can be combined with isolation methods such as
dedicated machines, virtual machines and chroot jails. The proxy can
also provide load balancing.
Setting up an Apache reverse proxy
The Apache reverse proxy setup is really simple. Ensure the modules
proxy and proxy_http are loaded. Then add two
simple rules to the server configuration. Below is an example that makes
a PlDoc server on port 4000 available from the main Apache server at
port 80.
ProxyPass /pldoc/ http://localhost:4000/pldoc/
ProxyPassReverse /pldoc/ http://localhost:4000/pldoc/
Apache rewrites the HTTP headers passing by, but using the above
rules it does not examine the content. This implies that URLs embedded
in the (HTML) content must use relative addressing. If the locations on
the public and Prolog server are the same (as in the example above) it
is allowed to use absolute locations. I.e. /pldoc/search is
ok, but http://myhost.com:4000/pldoc/search is not.
If the locations on the server differ, locations must be relative (i.e. not
start with /
This problem can also be solved using the contributed Apache module
proxy_html that can be instructed to rewrite URLs embedded
in HTML documents. In our experience, this is not troublefree as URLs
can appear in many places in generated documents. JavaScript can create
URLs on the fly, which makes rewriting virtually impossible.
