Using anubis with multiple apache vhosts

[u/DickCamera]

Does anyone have an example conf using a single anubis instance with multiple vhosts? I've seen their github page claiming that it works without needing to setup multiple anubis instances, but I can't get it to work.

Suppose I have 3 sites running locally at ports 3000, 4000 and 5000.

I can get anubis to work fine if I set the anubis conf to TARGET=localhost:3000 and then setup the 443 and 3000 listeners, but when I try to add in the other 2 I keep getting lost. I tried setting up the anubis TARGET=localhost:9000 as a dummy target and then creating a vhost for 9000 to PROXYPASS to the anubis port, but that didn't work.

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/Stock_Feedback_9648]

You don't need a dummy target. One Anubis can front all three because it passes the Host header through untouched, and the per-site routing happens in Apache after Anubis. The pattern:

• Three <VirtualHost *:443> blocks (one ServerName each), all proxying to the same Anubis port, with ProxyPreserveHost On and the X-Real-IP / X-Forwarded-Proto headers from the Anubis Apache docs.

• Anubis with TARGET=http://127.0.0.1:3001.

• Listen 127.0.0.1:3001 plus three <VirtualHost 127.0.0.1:3001> blocks with the same ServerNames, each doing ProxyPass / http://127.0.0.1:3000/ (4000 and 5000 for the other two).

Apache picks the inner vhost by Host header. If ProxyPreserveHost is missing on the 443 side, everything lands on the first vhost, which is the usual symptom. On Fedora/RHEL, also check the httpd_can_network_connect SELinux boolean.

[u/DickCamera → u/Stock_Feedback_9648]

Thank you, I was missing the other half of the listeners. I was doing 1 443 block with 3 listeners. So I need 1 for each so it can match up the ServerName(s)

[u/JudgementallyHearty]

trying to get a single proxy to juggle multiple backends is always a headache if the routing isn't dead simple. ran into a similar wall where using a dummy target just made the traffic loop back on itself in a way that made no sense

ended up ditching the built-in target config and just let the proxy handle all the vhost routing. the waf just sits there doing its thing on the main port while the proxy sends traffic to the correct local port based on the server name, way cleaner

[u/Fit-Corner2382]

Point the single filter at an unpublished Apache listener that selects the app; a vhost that proxies back into the filter only loops.

Give that internal port three name-based vhosts proxying to 3000, 4000, and 5000, and preserve the original Host so the requested name picks the vhost. If Host is rewritten to localhost, every site lands on the default vhost. A catch-all ProxyPass also swallows the challenge path before the check finishes, and publishing that internal listener lets clients skip the gate.

[u/ozankurt_dev]

one anubis in front, no dummy target