Apache reverse proxy

Apache is the default. The installer detects it first, and if apache2 or httpd is running it configures Apache and never looks at nginx. A Virtualmin box — the setup most installs use — is Apache out of the box.

Two processes need to be reachable through one hostname:

Enable the modules first

The directives below are inert without these. Newly enabled modules only load on a restart — a reload will not do it.

a2enmod proxy proxy_http proxy_wstunnel rewrite deflate http2 headers
systemctl restart apache2

On RHEL, CentOS and AlmaLinux the modules are normally compiled in and loaded from /etc/httpd/conf.modules.d. Check rather than assume:

for m in proxy proxy_http proxy_wstunnel rewrite deflate http2 headers; do
  apachectl -M 2>/dev/null | grep -q "${m}_module" || echo "MISSING: $m"
done

headers is needed for one line in the vhost below, and that line is a security control rather than a nicety — see Visitor addresses.

proxy_wstunnel is the one that gets forgotten. Without it the pages render, and the charts, order book and balances never update — the WebSocket upgrade is answered with an HTML page instead of a socket.

The directives

Paste this inside every <VirtualHost> for the site — both :80 and :443. Put it after the DirectoryIndex line, at vhost level, never inside a <Directory> or <Location> block.

Protocols h2 http/1.1
ProxyPreserveHost On
KeepAlive On
KeepAliveTimeout 3
MaxKeepAliveRequests 500
ProxyTimeout 150
AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css application/xml application/xhtml+xml application/rss+xml application/javascript application/x-javascript

# Discard any X-Forwarded-For the CLIENT sent. mod_proxy appends the real
# address to whatever arrives, so without this the backend receives
# "<whatever the caller typed>, <real client>". Requires mod_headers.
RequestHeader unset X-Forwarded-For

# Let certbot answer its own challenge instead of proxying it to Next.js.
ProxyPass /.well-known/acme-challenge !

ProxyPass /api/docs http://127.0.0.1:4000/api/docs
ProxyPassReverse /api/docs http://127.0.0.1:4000/api/docs

ProxyPass /api http://127.0.0.1:4000/api
ProxyPassReverse /api http://127.0.0.1:4000/api

# WebSockets. Must come BEFORE the catch-all ProxyPass below.
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule ^/api/(.*) ws://127.0.0.1:4000/api/$1 [P,L]

ProxyPass / http://127.0.0.1:3000/
ProxyPassReverse / http://127.0.0.1:3000/

<Proxy "http://127.0.0.1:4000/">
    ProxySet max=70000
</Proxy>

Then validate before reloading — a bad config will refuse to start and take the whole server down with it:

apache2ctl configtest && systemctl reload apache2

Why each line is there

Visitor addresses

One line in the vhost above is a security control:

RequestHeader unset X-Forwarded-For

Apache appends. mod_proxy adds the connecting address to whatever X-Forwarded-For the request already carried, rather than replacing it. So without this line, a caller who sends

X-Forwarded-For: 198.51.100.99

reaches the backend as 198.51.100.99, <their real address>. RequestHeader unset discards the client's copy first, so mod_proxy writes a single entry that the caller had no part in.

The backend reads the list right to left precisely so that a prepended forgery is ignored even without this line — but the line removes the ambiguity entirely, and costs nothing.

Upload size

Apache has no equivalent of nginx's 1 MB default, so uploads work without extra configuration. The platform's own cap is 5 MB (DEFAULT_MAX_BODY_BYTES = 5 * 1024 * 1024), and that is what rejects an oversized KYC document or avatar — not the web server.

If a LimitRequestBody is set anywhere in your config, make sure it is above 5 MB or it will reject uploads the platform would have accepted.

Virtualmin

Virtualmin writes a vhost per domain and rewrites those files when you change settings in its UI, so directives can be lost on a later edit. Add the block through Virtualmin's own Edit Directives for the domain rather than by editing the .conf by hand, and re-check after any Virtualmin change that touches the website.

If you bought a managed install, this is applied for you: the install service runs an idempotent script that inserts the block after the DirectoryIndex line in every vhost, validates with configtest, reloads, and reverts every file it touched if the validation fails.

Verify

curl -sI https://example.com/            | head -1   # 200, from Next.js
curl -sI https://example.com/api/health  | head -1   # 200, from the backend

For the WebSocket, open the platform in a browser and watch a market page: if prices tick, proxy_wstunnel is loaded and the rewrite rule is ordered correctly. If the page renders but nothing moves, that pairing is what to check first — see Troubleshooting.

Using nginx instead? See Nginx. You need one or the other, not both.