# Installing reverse proxy on ClearOS that uses certificates
This will help you install and configure reverse proxy for ClearOS. We demonstrate in this guide the use of Let's Encrypt but you can use any certificate.


#Preparation
You will need to install things from the Marketplace and also from command line.


## ClearOS Modules
Download and install the following support modules for ClearOS:
* Dynamic DNS
* Web Server
* Let's Encrypt

For Dynamic DNS, if you host a domain name with ClearOS you can easily tie the name of this server into the account for DNS and then create CNAME records on ClearOS for the various services that are running under this server.
If you do not host the DNS with ClearOS you can simply use a 'poweredbyclear.com' domain. If you are ok with just using that, feel free to use just that. If you would like to use your own hostnames, configure the 'poweredbyclear.com' DNS name for Dynamic DNS and then create CNAME records that point to that name for all of your services.

For Let's Encrypt to work it will need to talk to your ClearOS Web server on port 80. This is how it validates that you on the hostname that you are wanting to get a certificate for.

For Let's Encrypt you may get prompted for prerequisites to configure Master/Slave/Standalone (always pick Master if this is your first server for this customer). You may also need to set up the directory (usually OpenLDAP). And lastly, you may need to set up the certificate server.


## NGINx
The download and install the NGINX package for ClearOS is easy. From PuTTY run the following as root:

```
yum install nginx
```


# Configuration
You will need to configure and setup Dynamic DNS and Let's Encrypt using the ClearOS Web GUI. You will need to configure NGINx from command line.

## Web Server
This is pretty simple and you don't have to do much here. Simply start the Web server service and ensure that port 80 is open.

## Dynamic DNS
This is configured from the Cloud section of the Webconfig GUI. You can pick whatever you want for the first part of the hostname so long as someone else hasn't grabbed it. If you have your DNS hosted by ClearCenter (not recommended) then you can use a custom hostname with that domain via Dynamic DNS (kind of like a vanity plate). Otherwise, just make one for the 'poweredbyclear.com' domain.

## Let's Encrypt
The DNS must be working be working for this to properly register. You can register a number of different certificates provided that ALL of them resolve via DNS to this host and port 80 is open to the outside.
If you have to make changes to your Dynamic DNS, it will take up to 5 minutes for Let's Encrypt to be able to use it.

## NGINx
By default NGINx will conflict with the ClearOS Web Server (Apache Web Server) module on port 80. You will need to modify the default nginx.conf file in /etc/nginx/nginx.conf so that you comment out its default server configuration on port 80. Put hash marks in front of all these lines so that they look like this:


```
# server {
# listen 80 default_server;
# listen [::]:80 default_server;
# server_name _;
# root /usr/share/nginx/html;
#
# # Load configuration files for the default server block.
# include /etc/nginx/default.d/*.conf;
#
# location / {
# }
#
# error_page 404 /404.html;
# location = /40x.html {
# }
#
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# }
# }
```

Next, create a file called /etc/nginx/conf.d/proxypass.conf which contains something like this:

```
server {
listen 8888;
ssl on;
ssl_certificate /etc/letsencrypt/archive/something.poweredbyclear.com/fullchain1.pem;
ssl_certificate_key /etc/letsencrypt/archive/something.poweredbyclear.com/privkey1.pem;
location / {
proxy_pass http://192.168.1.10:81;
}
}
```

The 'listen 8888;' is the port that the server is listening on. You can make this 443 if you can get Apache to stop using that port.
The 'ssl_certificate' parameter points to the server certificate file. It is best to join the cert chain to the server cert. Let's encrypt does this for you with the fullchain1.pem file.
Let's Encrypt will place the current, active cert in the archive folder with the hostname of the cert. Point it there.
The 'ssl_certificate_key' file must point to the private key file for this domain.
Lastly the 'proxy_pass' line contains the internal lan URL for the service. It is important to remember that there is NO ENCRYPTION between the ClearOS server and this http server on the LAN. It is strongly advised to place ClearOS and this unsecure server on the same switch.

# Starting the services
Once configured, start the nginx service with the command:

```
systemctl start nginx
```

Look for any errors. If it starts ok, make sure to enable the service for boot:

```
systemctl enable nginx
```

# Cleaning up.
You may need to open the port you are using for NGINx to the outside. It is also highly advised that you take precautions with reverse proxies. For example, placing the hosts on a HotLAN or even using a different ClearOS that is not your main firewall.