Btukfyl

Summary

I've read through a crapload of Google results and stackoverflow questions but can't figure this out. The core issue seem to be:

• Basic setup is Apache/2.4.10, libapache2-mod-wsgi-py3 4.3.0-1 and flask 1.0.2
  


• This was working fine before I setup HTTPS using certbot


• There are two subdomains setup in separate .conf files using virtualhosts. The .conf files are identical apart from the directories and project names/URLs


• The Apache logs indicate that request is somehow redirected from project_2 URL to project_1 WSGI script, and I don't understand why


• If anyone could please point me in the right direction I'd be eternally grateful

Apache logs:


[ssl:debug] ssl_engine_kernel.c(243): AH02034: Initial (No.1) HTTPS request received for child 67 (server project_2.domain.com:443)
[authz_core:debug] mod_authz_core.c(809): AH01626: authorization result of Require all denied: denied
[authz_core:debug] mod_authz_core.c(809): AH01626: authorization result of <RequireAny>: denied
[authz_core:error] AH01630: client denied by server configuration: /home/username/projects/project_1/app/run_site.wsgi
[ssl:debug] ssl_engine_kernel.c(243): AH02034: Subsequent (No.2) HTTPS request received for child 68 (server project_2.domain.com:443), ref$
[authz_core:debug] mod_authz_core.c(809): AH01626: authorization result of Require all denied: denied, referer: https://www.project_2.domain.com/
[authz_core:debug] mod_authz_core.c(809): AH01626: authorization result of <RequireAny>: denied, referer: https://www.project_2.domain.com/
authz_core:error] AH01630: client denied by server configuration: /home/username/projects/project_1/app/run_site.wsgi, referer: https://www.project_2.domain.com/


Apache .conf files

/etc/apache2/sites-available/project_2.conf

WSGIDaemonProcess project_2 user=username group=username threads=5

WSGIScriptAlias / "/home/username/projects/project_2/run_site.wsgi"



<VirtualHost *:80>

        ServerName project_2.domain.com

        ServerAlias www.project_2.domain.com



        <Directory "/home/username/projects/project_2/">

                WSGIProcessGroup project_2

                WSGIApplicationGroup %{GLOBAL}

                WSGIScriptReloading On



                Require all granted

        </Directory>



        ErrorLog ${APACHE_LOG_DIR}/notifier_error.log

        CustomLog ${APACHE_LOG_DIR}/notifier_access.log combined

RewriteEngine on

RewriteCond %{SERVER_NAME} =www.project_2.domain.com [OR]

RewriteCond %{SERVER_NAME} =project_2.domain.com

RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

/etc/apache2/sites-available/project_2-le-ssl.conf

<IfModule mod_ssl.c>

<VirtualHost *:443>

        ServerName project_2.domain.com

        ServerAlias www.project_2.domain.com



        <Directory "/home/username/projects/project_2/">

                WSGIProcessGroup project_2

                WSGIApplicationGroup %{GLOBAL}

                WSGIScriptReloading On



                Require all granted

        </Directory>



        ErrorLog ${APACHE_LOG_DIR}/project_2_error.log

        CustomLog ${APACHE_LOG_DIR}/project_2_access.log combined

Include /etc/letsencrypt/options-ssl-apache.conf

SSLCertificateFile /etc/letsencrypt/live/www.project_2.domain.com/fullchain.pem

SSLCertificateKeyFile /etc/letsencrypt/live/www.project_2.domain.com/privkey.pem

</VirtualHost>

</IfModule>

sudo apachectl -S:


VirtualHost configuration:
*:443 is a NameVirtualHost
default server project_1.domain.com (/etc/apache2/sites-enabled/project_1-le-ssl.conf:2)
port 443 namevhost project_1.domain.com (/etc/apache2/sites-enabled/project_1-le-ssl.conf:2)
alias www.project_1.domain.com
port 443 namevhost project_2.domain.com (/etc/apache2/sites-enabled/project_2-le-ssl.conf:2)
alias www.project_2.domain.com
*:80 is a NameVirtualHost
default server project_1.domain.com (/etc/apache2/sites-enabled/project_1.conf:4)
port 80 namevhost project_1.domain.com (/etc/apache2/sites-enabled/project_1.conf:4)
alias www.project_1.domain.com
port 80 namevhost project_2.domain.com (/etc/apache2/sites-enabled/project_2.conf:4)
alias www.project_2.domain.com
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/lock/apache2" mechanism=fcntl
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
Define: ENABLE_USR_LIB_CGI_BIN
User: name="www-data" id=33
Group: name="www-data" id=33


OK I figured out my mistake. When I was setting up certbot I moved both these lines outside the virtual host:

WSGIDaemonProcess project_2 user=username group=username threads=5

WSGIScriptAlias / "/home/username/projects/project_2/run_site.wsgi"

This lead to two WSGIScriptAlias lines in both my .conf files, one was overriding the other. What fixed this is bringing the WSGIScriptAlias inside the virtual host in both scripts project_1.conf and project_2.conf, as well as adding it manually back into project_1-le-ssl.conf and project_2-le-ssl.conf

Resulting .conf example:

WSGIDaemonProcess project_2 user=username group=username threads=5



<VirtualHost *:80>

        ServerName project_2.domain.com

        ServerAlias www.project_2.domain.com



        WSGIScriptAlias / "/home/username/projects/project_2/run_site.wsgi"



        <Directory "/home/username/projects/project_2/">

                WSGIProcessGroup project_2

                WSGIApplicationGroup %{GLOBAL}

                WSGIScriptReloading On



                Require all granted

        </Directory>



        ErrorLog ${APACHE_LOG_DIR}/notifier_error.log

        CustomLog ${APACHE_LOG_DIR}/notifier_access.log combined

RewriteEngine on

RewriteCond %{SERVER_NAME} =www.project_2.domain.com [OR]

RewriteCond %{SERVER_NAME} =project_2.domain.com

RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>