如何在Apache反向代理中通过ProxyPass发送ProxyProtocol代理协议？

前置要求 #

• Apache HTTP Server 版本 ≥ 2.4.30，该版本开始原生支持反向代理场景下向外发送Proxy Protocol报文
• 已启用mod_proxy、mod_proxy_http、mod_proxy_wstunnel必要模块，Debian/Ubuntu系可执行以下命令启用：

a2enmod proxy proxy_http proxy_wstunnel
systemctl restart apache2

配置修改 #

在原有VirtualHost配置中补充Proxy Protocol发送参数即可，修改后的示例配置如下：

<VirtualHost *:443>
    ServerAdmin webmaster@localhost
    ServerName x.y.z

    SSLEngine on

    SSLCertificateFile    /etc/letsencrypt/live/xyz/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/xyz/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/xyz/chain.pem

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    RewriteEngine On
    ProxyPreserveHost On

    # 新增配置：给后端HTTP、WebSocket服务统一开启Proxy Protocol发送
    ProxySet http://receiving-host/ proxyprotocol=on
    ProxySet ws://receiving-host/ proxyprotocol=on

    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*)           ws://receiving-host/$1 [P,L]

    ProxyPassMatch ^/.well-known !
    ProxyPass / http://receiving-host/
    ProxyPassReverse / http://receiving-host/

    RequestHeader set "X-Real-IP" "%{REMOTE_ADDR}s"
    RequestHeader set "X-Forwarded-Proto" "%{REQUEST_SCHEME}s"
</VirtualHost>

补充说明 #

• 默认proxyprotocol=on对应发送Proxy Protocol v1版本报文，如需使用v2版本，替换为proxyprotocol=v2即可
• 配置修改完成后执行apache2ctl configtest检查语法无报错，再重启Apache生效
• 接收端需要提前完成mod_remoteip的Proxy Protocol配置，且将发送端Apache的IP加入可信代理列表，才能正确解析获取真实客户端IP

内容的提问来源于stack exchange，提问作者natli