= Bonita behind a reverse-proxy
:description: Learn how to set up a reverse proxy to expose Bonita web interface publicly while keeping the backend safe

Learn how to set up a reverse proxy to expose Bonita web interface publicly while keeping the backend safe.

== Context

[WARNING]
====
Bonitasoft does not support anymore having Bonita portal running on a dedicated Tomcat server on one side, and Bonita Engine running on a dedicated Tomcat server on the other side.
====

If you have to expose Bonita Portal or a Bonita-developed application publicly, but legitimately want to protect any other resources behind your firewall, you should set up a software architecture similar to this one:

image::https://people.apache.org/~mturk/docs/article/fig2.gif[Tomcat behind a firewall with reverse proxy]

where the Web Server serves as a reverse proxy, and where the Tomcat server hosts Bonita.

== Using Apache 2 HTTP server (aka httpd)

Apache HTTP server proposes the following infrastructure, with optionally several Bonita backend servers:

image::https://httpd.apache.org/docs/current/images/reverse-proxy-arch.png[exposing Bonita backend servers behind a firewall]

Activate the 2 proxy modules by running the commands:

[source,bash]
----
sudo a2enmod proxy
sudo a2enmod proxy_http
----

To be able to customize URL rewrite rules, activate the rewrite module by running the command:

[source,bash]
----
sudo a2enmod rewrite
----

An example of Apache 2 HTTP server configuration that works with Bonita could be:

`your_domain.conf`:

[source,xml]
----
<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    ServerName your_domain
    ServerAlias www.your_domain.com
    DocumentRoot /var/www/your_domain
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    RewriteEngine  on
    RewriteRule    "^(?!/bonita)(.*)$"  "/bonita$1" [R,L]
    RewriteRule    "^/(.*)"  "http://127.0.0.1:8080/$1" [P]

    ProxyRequests Off

    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>

    ProxyPass / http://127.0.0.1:8080/
    ProxyPassReverse / http://127.0.0.1:8080/

    <Location />
        Order allow,deny
        Allow from all
    </Location>

</VirtualHost>
----

Make sure to also xref:ssl.adoc#_tomcat_and_ssl_offloading[configure Tomcat IP Valve] for IP and protocol forwarding.

Read https://httpd.apache.org/docs/current/howto/reverse_proxy.html[the complete Apache httpd documentation] for detailed configuration capabilities.

== Using NGINX

NGINX proposes the same functionality.

Read the https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/[official NGINX reverse proxy documentation]
