{"id":3386,"date":"2024-10-17T15:39:06","date_gmt":"2024-10-17T22:39:06","guid":{"rendered":"https:\/\/spiffynasty.com\/blahblahblah\/?p=3386"},"modified":"2024-10-17T15:39:06","modified_gmt":"2024-10-17T22:39:06","slug":"reverse-proxy-internal-and-external-urls-w-wordpress","status":"publish","type":"post","link":"https:\/\/spiffynasty.com\/blahblahblah\/reverse-proxy-internal-and-external-urls-w-wordpress\/","title":{"rendered":"Reverse Proxy & Internal and External Urls w\/ WordPress"},"content":{"rendered":"

How the Reverse Proxy Handles HTTP to HTTPS<\/h3>\n

When you set up a reverse proxy, here\u2019s how it works:<\/p>\n

    \n
  1. \n

    External HTTPS Request:<\/strong><\/p>\n

      \n
    • A user visits https:\/\/spiffynasty.com\/blahblahblah\/<\/code> (secured with HTTPS).<\/li>\n
    • The reverse proxy (on spiffynasty.com<\/code>) receives this request over HTTPS.<\/li>\n<\/ul>\n<\/li>\n
    • \n

      Internal Forwarding to HTTP:<\/strong><\/p>\n

        \n
      • The reverse proxy forwards this request internally to your NAS using HTTP, like http:\/\/192.168.1.30\/blahblahblah\/<\/code>.<\/li>\n
      • The connection between spiffynasty.com<\/code> and 192.168.1.30<\/code> (your NAS) is happening over your local network<\/strong>, so it\u2019s secure in the sense that it\u2019s not exposed to the outside world.<\/li>\n<\/ul>\n<\/li>\n
      • \n

        Response from NAS:<\/strong><\/p>\n

          \n
        • Your NAS (192.168.1.30<\/code>) serves the requested content back to the reverse proxy over HTTP.<\/li>\n<\/ul>\n<\/li>\n
        • \n

          Secure Response to the Client:<\/strong><\/p>\n

            \n
          • The reverse proxy then encrypts the response (via HTTPS) and sends it back to the user as https:\/\/spiffynasty.com\/blahblahblah\/<\/code>.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n

            Why It\u2019s Safe:<\/h3>\n

            The critical point is that the public-facing<\/strong> side (what users interact with) is over HTTPS, secured by the certificate you set up on spiffynasty.com<\/code>. The internal communication between spiffynasty.com<\/code> and 192.168.1.30<\/code> happens over HTTP because:<\/p>\n

              \n
            • It\u2019s within your local network (e.g., 192.168.x.x range), which isn\u2019t accessible to the public.<\/li>\n
            • For most local network setups, this is considered secure, as it\u2019s unlikely anyone can snoop on traffic inside your private LAN.<\/li>\n<\/ul>\n

              Key Role of the Reverse Proxy:<\/h3>\n

              The reverse proxy acts as the "translator":<\/p>\n

                \n
              • It terminates the SSL<\/strong> (HTTPS) connection, meaning it handles the encryption and decryption for the public-facing side.<\/li>\n
              • It communicates with your NAS<\/strong> using HTTP, which doesn\u2019t require SSL because it's inside your private network.<\/strong><\/li>\n<\/ul>\n

                Internal and External urls w\/ WordPress<\/h2>\n

                Using http:\/\/192.168.1.30<\/code> in the WordPress database for the site URL<\/strong> (both the siteurl<\/code> and home<\/code> options) might seem like a convenient way to ensure the site works locally even if the reverse proxy goes down, but there are a few important considerations and trade-offs:<\/p>\n

                1. Internal URL vs. External URL<\/strong><\/h3>\n

                If you set the siteurl<\/code> and home<\/code> in the WordPress database to http:\/\/192.168.1.30<\/code> (the internal IP of the NAS), WordPress will generate links and assets (like CSS, JavaScript, and images) using this internal IP address, which could cause issues when accessing the site externally via the reverse proxy (https:\/\/spiffynasty.com<\/code>).<\/p>\n

                Why this is a problem:<\/h4>\n
                  \n
                • Broken Links for External Visitors<\/strong>: All URLs (like posts, media files, etc.) would point to http:\/\/192.168.1.30<\/code>, which is not accessible from the outside world. Visitors going to https:\/\/spiffynasty.com<\/code> will see these internal links, causing content to fail to load.<\/li>\n
                • Mixed Content Warnings<\/strong>: If your reverse proxy is serving the site over HTTPS, but assets are still loaded from http:\/\/192.168.1.30<\/code> (HTTP), browsers will block these resources or show "mixed content" warnings, making the site appear insecure.<\/li>\n<\/ul>\n

                  2. How to Handle Local Access<\/strong><\/h3>\n

                  There are better ways to ensure that the site works locally and externally without hardcoding http:\/\/192.168.1.30<\/code> into the database:<\/p>\n

                  a. Use spiffynasty.com<\/code> as the Site URL<\/strong><\/h4>\n

                  Keep https:\/\/spiffynasty.com\/blahblahblah<\/code> in the database as the site URL<\/strong>. This ensures that all URLs and assets are correctly served for external visitors, but also works fine for local access through the reverse proxy.<\/p>\n

                  When you access the site locally via http:\/\/192.168.1.30<\/code>, the reverse proxy can still forward requests correctly, so your site will load as expected, with the links pointing to spiffynasty.com<\/code>. Since the NAS serves the content locally, it will work.<\/p>\n

                  b. Use a Conditional in wp-config.php<\/code> for Local and External Access<\/strong><\/h4>\n

                  You can set up WordPress to detect whether you're accessing it locally or through the reverse proxy and adjust the site URL accordingly. Here's how:<\/p>\n

                  In wp-config.php<\/code>, add a conditional statement like this:<\/p>\n

                  \r\nif ($_SERVER['REMOTE_ADDR'] == '192.168.1.30') {\r\n    define('WP_HOME', 'http:\/\/192.168.1.30\/blahblahblah');\r\n    define('WP_SITEURL', 'http:\/\/192.168.1.30\/blahblahblah');\r\n} else {\r\n    define('WP_HOME', 'https:\/\/spiffynasty.com\/blahblahblah');\r\n    define('WP_SITEURL', 'https:\/\/spiffynasty.com\/blahblahblah');\r\n}\r\n<\/code><\/pre>\n
                  This way, if you're accessing the site from the local network, WordPress will use http:\/\/192.168.1.30<\/code>, and if you're accessing it from anywhere else, it will use the public https:\/\/spiffynasty.com<\/code> URL.<\/p>\n
                  3. Handling Media and Assets<\/strong><\/h3>\n
                  One potential issue with switching URLs dynamically is that WordPress stores absolute URLs for media files in the database. If you use the internal IP (192.168.1.30<\/code>), media links will be stored using this address, which can cause broken links when accessing the site externally.<\/p>\n
                  To avoid this:<\/p>\n
                    \n
                  • Keep the site URLs as the public-facing ones (e.g., https:\/\/spiffynasty.com<\/code>).<\/li>\n
                  • Access the site locally through the reverse proxy as much as possible.<\/li>\n<\/ul>\n
                    4. Database Considerations<\/strong><\/h3>\n
                    If you decide to switch the URLs between local\/internal and external, you may also need to replace URLs in the database whenever you change the setup (for example, using search-and-replace tools like Better Search Replace<\/strong>). This isn't ideal for dynamic environments where both internal and external access is required regularly.<\/p>\n
                    Conclusion<\/h3>\n
                    It\u2019s generally best to keep the public-facing URL<\/strong> (https:\/\/spiffynasty.com<\/code>) as the site URL in the WordPress database. This avoids external visitors encountering issues with internal IPs and ensures proper SSL and link handling.<\/p>\n
                    However, you can use conditionals in wp-config.php<\/code> to allow for local access using http:\/\/192.168.1.30<\/code> if needed.<\/p>\n","protected":false},"excerpt":{"rendered":"
                    How the Reverse Proxy Handles HTTP to HTTPS When you set up a reverse proxy, here\u2019s how it works: External HTTPS Request: A user visits https:\/\/spiffynasty.com\/blahblahblah\/ (secured with HTTPS). The reverse proxy (on spiffynasty.com) receives this request over HTTPS. Internal Forwarding to HTTP: The reverse proxy forwards this request internally to your NAS using HTTP, like http:\/\/192.168.1.30\/blahblahblah\/. The connection between spiffynasty.com and 192.168.1.30 (your NAS) is happening over your local network, so it\u2019s secure in the sense that it\u2019s not exposed to the outside world. Response from NAS: Your NAS (192.168.1.30) serves the requested content back to the reverse proxy over HTTP. Secure Response to the Client: The reverse proxy then encrypts the response (via HTTPS) and sends it back to the user as https:\/\/spiffynasty.com\/blahblahblah\/. Why It\u2019s Safe: The critical point is that the public-facing side (what users interact with) is over HTTPS, secured by the certificate you set up on spiffynasty.com. The internal communication […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[65,27],"tags":[],"class_list":["post-3386","post","type-post","status-publish","format-standard","hentry","category-frontpage","category-nas"],"_links":{"self":[{"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/posts\/3386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/comments?post=3386"}],"version-history":[{"count":1,"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/posts\/3386\/revisions"}],"predecessor-version":[{"id":3387,"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/posts\/3386\/revisions\/3387"}],"wp:attachment":[{"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/media?parent=3386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/categories?post=3386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/spiffynasty.com\/blahblahblah\/wp-json\/wp\/v2\/tags?post=3386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}