Reverse proxy for Lektor CMS

Question

The Lektor server is running on port 5000 on localhost. I want to make it accessible via an Apache URL at http://myhost.org/lektor. Therefore, I've tried the httpd config snippet

ProxyPass        /lektor http://127.0.0.1:5000
ProxyPassReverse /lektor http://127.0.0.1:5000

The HTML for the welcome page is found, but the static pages referenced there (e.g., http://myhost.org/static/style.css) are not. How can I make the changed URL known to Lektor?

Answer 1

The development server is not intended to be used for production. The production deployments are based on entirely static content and will resolve static assets correctly if you use the |url filter.

Answer 2

I had success with just slightly different syntax:

ProxyPass / "http://localhost:5000/"
ProxyPassReverse / "http://localhost:5000/"

Seems the trailing slash is needed. I'm not sure whether you need the actual name "localhost" in there, but that's what worked for me.

I did the following additional items with my setup, and it's rather slick:

• Set up Lektor on an internal private-ip webserver
• Set up two virtual hosts, for example lektor-web-dev.my.domain and lektor-web.my.domain
• Set up self-signed certificates on the -dev domain, and used the above ProxyPass items in its vhost config (Apache)
• Set up basic authentication on the -dev domain, so there's at least a basic level of authentication
• Set up rsync deploy to loop back to localhost using an SSH keypair, and copy the output files to lektor-web.my.domain's webroot

Now, lektor-web.my.domain is still on a private webserver without certificates. However, on my public-facing webserver, I SSL terminate and proxy through to lektor-web.my.domain. I get the certificate with letsencrypt.

This is expandable to any number of websites. Keep the Lektor admins running using supervisor or some other process management system. Use 'lektor server -p portnum' to pick a different port for each site's admin. You can do group-based access to various admins using HTTP basic authentication along with an htpasswd and htgroup file.