Apache2 reverse proxy vhost configuration for Plex. Rerquires modules ssl, proxy, wstunnel

apache-plex-reverse-proxy.vhost

This current configuration is based of at least Server Version 1.16.5.1488 and Web Version: 3.108.2.
This updated config file allows the playing of trailers and TV Show theme music where as the previous one did not.

## Requirements

1. Apache version > 2.4
2. A bunch of mod's enabled (proxy, ssl, proxy_wstunnel, http, dir, env, headers, proxy_balancer, proxy_http, rewrite)
3. Protocols h2 http/1.1 needs apachectl -V 2.4.17 and higher...

## Apache .conf file

```
    DEFINE plex_url 127.0.0.1
    DEFINE plex_port 32400
    DEFINE public_url subdomain.plex.tv
    DEFINE email admin@subdomain.plex.tv
    ServerTokens Prod
    SSLStaplingCache "shmcb:${APACHE_LOG_DIR}/stapling-cache(150000)"
    SSLSessionCache "shmcb:${APACHE_LOG_DIR}/ssl_scache(512000)"
    SSLSessionCacheTimeout 300
### If you have Google's Mod PageSpeed, disable it
    #ModPagespeed Off
<VirtualHost *:80>
    ServerName ${public_url}
    DocumentRoot /var/www/offline
    ServerAdmin ${email}
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =${public_url}
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
<VirtualHost *:443>
    ServerName ${public_url}
    DocumentRoot /var/www/offline
    ServerAdmin ${email}
    ErrorLog ${APACHE_LOG_DIR}/${public_url}.error.log
    CustomLog ${APACHE_LOG_DIR}/${public_url}.access.log combined
    SSLEngine On
    SSLCertificateFile /etc/letsencrypt/live/${public_url}/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/${public_url}/privkey.pem
    #Include /etc/letsencrypt/options-ssl-apache.conf
### Forbid the http1.0 protocol ###
    Protocols h2 http/1.1
    #Options -Includes -ExecCGI
    #LimitRequestBody 512000
    #FileETag None
    #TraceEnable off
    Timeout 360
    ProxyRequests Off
    ProxyPreserveHost On
    ProxyTimeout 600
    ProxyReceiveBufferSize 4096
    SSLProxyEngine On
    RequestHeader set Front-End-Https "On"
    ServerSignature Off
    SSLCompression Off
    SSLUseStapling On
    SSLStaplingResponderTimeout 5
    SSLStaplingReturnResponderErrors Off
    SSLSessionTickets Off
    RequestHeader set X-Forwarded-Proto 'https' env=HTTPS
    Header always set Strict-Transport-Security "max-age=15552000; preload"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Robots-Tag none
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Content-Security-Policy "default-src 'self' https:; font-src 'self' data: ${plex_url} ${public_url}; media-src 'self' blob: data: https: ${plex_url} ${public_url} *.plex.direct *.plex.tv plex.tv; script-src 'self' 'unsafe-inline' 'unsafe-eval' ${plex_url} ${public_url} plex.tv *.plex.tv gstatic.com *.gstatic.com *.plex.direct; style-src 'self' ${plex_url} ${public_url} *.plex.direct 'unsafe-inline'; img-src 'self' data: blob: ${plex_url} ${public_url} plex.tv *.plex.tv *.plex.direct; worker-src *; frame-src 'none'; connect-src 'self' wss: https: ${plex_url} ${public_url} plex.tv *.plex.direct *.plex.tv;"
    Header always set Feature-Policy "geolocation 'self'; midi 'self'; sync-xhr 'self'; microphone 'self'; camera 'self'; magnetometer 'self'; gyroscope 'self'; speaker 'self'; fullscreen 'self'; payment 'self'"
	### Use next two for very secure connections ###
	SSLHonorCipherOrder On
	SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
	SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
	### Use next two for secure connections and supports more endpoints ###
	#SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
	#SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
	### Actually proxy the traffic and really the only important part ###
	ProxyPassMatch ^/.well-known !
	ProxyPass / http://${plex_url}:${plex_port}/
	ProxyPassReverse / http://${plex_url}:${plex_port}/
	ProxyPass /:/ ws://${plex_url}:${plex_port}/:/
	ProxyPassReverse /:/ ws://${plex_url}:${plex_port}/:/
	ProxyPass /:/ wss://${plex_url}:${plex_port}/:/
	ProxyPassReverse /:/ wss://${plex_url}:${plex_port}/:/
	LimitRequestBody 512000
	FileETag None
	TraceEnable off
	#Header edit Set-Cookie ^(.*)$ ;HttpOnly;Secure
	Timeout 60
	<Location /:/websockets/notifications>
		ProxyPass wss://${plex_url}:${plex_port}/:/websockets/notifications
		ProxyPassReverse wss://${plex_url}:${plex_port}/:/websockets/notifications
	</Location>
	<Proxy *>
	  Require all granted
	</Proxy>
	RewriteEngine on
	RewriteCond %{REQUEST_URI} !^/web
	RewriteCond %{HTTP:X-Plex-Device} ^$
	RewriteCond %{REQUEST_METHOD} !^(OPTIONS)$
	RewriteCond %{QUERY_STRING} (^|&)X-Plex-Device=(&|$) [OR]
	RewriteCond %{QUERY_STRING} !(^|&)X-Plex-Device=
	RewriteRule ^/$ /web/$1 [R,L]
</VirtualHost>
```

If you connect directly to Plex: http://ip.ad.re.ss:32400/web, do you experience these weird timeouts and/or transcoding problems?

If you connect directly to Plex: http://ip.ad.re.ss:32400/web, do you experience these weird timeouts and/or transcoding problems?

no issue when open port directly to plex(even via cloudflare. Issue only when i go thru apache proxy.

UPDATE: Found the root cause to be traffic proxy to plex docker seems to causing the timeout.

Reviewing my reverse proxy the CSP change needed is to do with img-src now, it seems images are now being served from a path of:

https://ip.hash.plex.direct, the rule of *.plex.direct no longer matches, because of the hash, subdomain of subdomain, you can probably get away with just allowing https: for img-src to avoid having to add loads of specific rules.

Otherwise, it works fine and can play content through the web and mobile app, no changes other than CSP.

For my configuration, a proxy server - it was enough to add the *.plex.direct:32400 for img-src

@Tipz Ah thanks, yes that's a better rule if you want to be selective. You could still use https: generally to avoid having all of the conditions, some of them might not be valid anymore.

@hazcod The header 'Feature-Policy' can be renamed to 'Permissions-Policy' due to the specification change, it may need reformatting as the specification changed.

Does anyone know how to fix the errors regarding /:/websockets/notifications? I am constantly getting the videos freezing and the logs showing Error during SSL Handshake with remote server returned by /:/websockets/notifications.

@simao-silva That would suggest the WebSocket requests are not being properly proxied. Do any console errors show up related to WebSocket issues when browsing your reverse proxy domain?

As a debugging step you could try applying the following:

SSLProxyEngine on
SSLProxyVerify none 
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off

However, be mindful this basically disables any SSL/TLS validation, so don't leave enabled but for testing purposes.

Does your reverse proxy have a valid SSL certificate?

After long battle with freezing video. I fixed it with few changes. I am not sure which one really fixed it.

On plex ensure the certificate.pfx is set to my to domain generated. U need to put full path from root
Custom certificate location: /var/lib/plexmediaserver/certificate.pfx
Debug and restart plex make sure the cert is used. clear the cert cache if needed(i forgot how)

https instead of http.

	ProxyPass / https://${plex_url}:${plex_port}/ 
	ProxyPassReverse / https://${plex_url}:${plex_port}/

Keep alive on. I got random proxy timeout without this. Seems there is too much thread opened. Thus keepalive on to prevent that.

	KeepAlive on

I dont have error after make these setting.
Server version: Apache/2.4.51 (Debian)

@tyjtyj Interesting, thanks for sharing. Adding keepalive to the ProxyPass might be something to add to the main config.

It is worth pointing out if you change the ProxyPass/ProxyPassReverse to https, you must configure a valid SSL certificate. I believe this means configuring a custom one your Plex instance, otherwise you will get "Error during SSL Handshake" errors. This will be because of a common name mismatch. The configuration detailed here, typically focuses on providing a valid SSL certificate for the proxy, but not for the traffic between the proxy, which is why it's using plain http.

You can technically change the proxy to https:// without doing this but you'll have to disable one or more SSL checks, which is not recommended due to higher risk of MITM, however if the traffic is being proxied locally, then it's not as bad.

Below is a "test" config for using Plex as a subdirectory. It needs an additional apache2 mod called proxy_html and assumes a subdirectory of "plex":

### Plex subdirectory test
    RewriteEngine on
    RewriteCond %{REQUEST_URI} !^/plex/web
    RewriteCond %{HTTP:X-Plex-Device} ^$
    RewriteCond %{REQUEST_METHOD} !^(OPTIONS)$
    RewriteCond %{QUERY_STRING} (^|&)X-Plex-Device=(&|$) [OR]
    RewriteCond %{QUERY_STRING} !(^|&)X-Plex-Device=
    RewriteRule ^/$ /plex/web/$1 [R,L]
<Location /web>
    ProxyPass http://192.168.1.109:32400/web retry=0
    ProxyPassReverse http://192.168.1.109:32400/web
    SetOutputFilter proxy-html
    ProxyHTMLURLMap http://192.168.1.109:32400/web
</Location>
RewriteRule ^/web$ /plex/web/ [R]
<Location /media>
    ProxyPass http://192.168.1.109:32400/media retry=0
    ProxyPassReverse http://192.168.1.109:32400/media
    SetOutputFilter proxy-html
    ProxyHTMLURLMap http://192.168.1.109:32400/media
</Location>
RewriteRule ^/media$ /plex/media/ [R]
<Location /plex/:>
    ProxyPass wss://192.168.1.109:32400/:
    ProxyPassReverse wss://192.168.1.109:32400/:
</Location>
RewriteRule ^/plex/:$ /plex/:/ [R]
<Location /plex>
    ProxyPass http://192.168.1.109:32400 retry=0
    ProxyPassReverse http://192.168.1.109:32400
    SetOutputFilter proxy-html
    ProxyHTMLURLMap http://192.168.1.109:32400
</Location>
RewriteRule ^/plex$ /plex/ [R]

In my testing, it appears to be working. Tested playing some music and hearing the TV Show theme music play. Make sure you change the 192.168.1.109:32400 to the IP and port of your Plex server.

Very cool of you to share the config.
I tried it but I cannot get it to work.

If I set it up with the modifications needed for my system I only get a 404 page not found.
When I modify the http to https here:
ProxyPass / https://${plex_url}:${plex_port}/
ProxyPassReverse / https://${plex_url}:${plex_port}/
I get Error during SSL Handshake with remote server

If I then add these lines:
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off

I get again the 404.

Any Idea where I'm doing something wrong?

Thanks Chris

@chrihuc Is this proxying a subdomain or sub directory? Check that you can access the path being proxied outside of Apache first. 404 suggests it's hitting something, but maybe not what you think.

The SSL handshake error is expected without additional configuration not covered here, as the SSL certificate you provide for a custom domain is not going to match the Plex domain that is proxied. For simplicity, just proxy HTTP, but you'll have to keep Plex secure connections as "preferred" and not set it to "forced". Also be aware disabling all those SSL directives is a security risk. You actually only need SSLProxyCheckPeerName off to avoid the 502 error.

I'm proxying a subdomain, doing this already for Grafana.
Anyway I was about to look into it again right now, and guess what, it works... I have not changed anything. Not sure if I had still a bad route in my laptop.

Thanks all the same!

btw. I had the SSL directives only shortly active, just for testing. Deactivated them directly after they did not improve the situation.

I was using this and it was working fine for all plex apps except for infuse: it was very slow within the infuse app. Adding
SSLProxyCheckPeerName off
to the SSL section solved this issue ...

Error I was seeing in the logs was:

Internal error (specific information not available): AH01084: pass request body failed to 172.20.1.2:32400 (172.20.1.2)
Error during SSL Handshake with remote server returned by /:/websockets/notifications

"Plex subdirectory test"

Unfortunately I am not getting this to work. No matter what I do Plex likes to respond from https://domain.com/web instead of https://domain.com/plex/web, however https://domain.com/plex actually forwards me to https://domain.com/web

Any ideas? I did use the provided configuration just by changing the Plex server IP address and each http:// to https://

Ubuntu 22.04.2 LTS
Apache 2.4.52
Plex Media Server 4.100.1

Thank you for this vhost configuration! After applying this configuration, I constantly got an error in /var/log/apache2/error.log containing these two lines:
"AH00898: Error during SSL Handshake with remote server returned by /:/websockets/notifications"
"AH01097: pass request body failed to <Local Plex Server IP Address>"
In the browser console it said that it could not connect to "wss://plex.<domain>.<tld>/:/websockets/notifications?X-Plex-Token=<token>" as well.

I then figured out what to change in the configuration to fix it. These errors made me unable to see new content popping up on the dashboard after scanning libraries. I had to refresh the page to see the new content. Context menus would also stop working randomly. Here are the changes I did to fix this:

The configuration below now contains "ws" instead of "wss":
Header always set Content-Security-Policy "default-src 'self' https:; font-src 'self' data: ${plex_url} ${public_url}; media-src 'self' blob: data: https: ${plex_url} ${public_url} *.plex.direct *.plex.tv plex.tv; script-src 'self' 'unsafe-inline' 'unsafe-eval' ${plex_url} ${public_url} plex.tv *.plex.tv gstatic.com *.gstatic.com *.plex.direct; style-src 'self' ${plex_url} ${public_url} *.plex.direct 'unsafe-inline'; img-src 'self' data: blob: ${plex_url} ${public_url} plex.tv *.plex.tv *.plex.direct; worker-src *; frame-src 'none'; connect-src 'self' ws: https: ${plex_url} ${public_url} plex.tv *.plex.direct *.plex.tv;"

I have commented out these lines since I don't think they are necessary. It does not affect the problem, though:

#ProxyPass /:/ wss://${plex_url}:${plex_port}/:/
#ProxyPassReverse /:/ wss://${plex_url}:${plex_port}/:/

The two lines inside the Location directive now contains ws instead of wss:

<Location /:/websockets/notifications>
        ProxyPass ws://${plex_url}:${plex_port}/:/websockets/notifications
        ProxyPassReverse ws://${plex_url}:${plex_port}/:/websockets/notifications
</Location>

Restart Apache, and the errors should no longer appear, at least for systems with similar setup and configuration described below. Maybe someone finds this helpful.

Setup:
Debian 12
Apache 2.4.57
Plex Media Server 4.108.0
My setup uses no SSL certificate for Plex itself, only for Apache with reverse proxy.