[Question] Sample to host 2 domainnames on https (433)

[JeepNL]

I would love to try out YARP on Ubuntu 20.04 and use it for 2 live .NET 5 (preview) Blazor WASM/gRPC websites (live but prototypes).

So, not for load balancing, but just to be able to host 2 instances of Kestrel (serving different domainnames on (internal) different ports) on one VPS with YARP in front of it serving those websites on one https (433) external port with http2 for gRPC.

Getting an A+ grade at Qualys SSL labs (and a 100% score at https://en.internet.nl/) is really important to me, and if the sample could contain code on how to achieve this with sample code from this discussion (Cipher Suit Preference) it would be very helpful to me and imo to others to use it.

I know (from that same issue) how to setup openssl.cnf on Ubuntu

I did this previously with NGINX, but as I said I would love to try out YARP in this configuration so I could use Microsoft software only (and because YARP is pretty, pretty fast so I'm told 😉)

[Tratcher]

Good questions, these are all things we still need docs for (#305). Let's take this as three different parts.

A) A+ TLS config scores on linux: We're tracking that over at dotnet/runtime#30767 as you've noticed. Its a long conversation but I think the highlights are dotnet/runtime#30767 (comment) and dotnet/runtime#30767 (comment). Please give those options a try and ask any questions you need on that issue. You shouldn't need to do anything YARP specific.

B) Hosting multiple domains on the same port: The TLS feature for this is called SNI and is something you configure in Kestrel.

Kestrel has a new config feature for this in 5.0.0-RC1, which isn't quite out yet but you should be able to try a daily build.

If you need to do this in any prior version then you can use the ServerCertificateSelector callback. It lets you check the incoming domain name for each new connection and provided the matching certificate.

C) Configure YARP to route by domain name: Run through the getting started guide and then tweak the config like this:

{
 "Logging": {
   "LogLevel": {
     "Default": "Information",
     "Microsoft": "Warning",
     "Microsoft.Hosting.Lifetime": "Information"
   }
 },
 "AllowedHosts": "*",
 "ReverseProxy": {
   "Routes": [
     {
       "RouteId": "route1",
       "ClusterId": "cluster1",
       "Match": {
         "Hosts": [ "PublicDomain1" ] 
       },
     },
     {
       "RouteId": "route2",
       "ClusterId": "cluster2",
       "Match": {
         "Hosts": [ "PublicDomain2" ] 
       },
     }
   ],
   "Clusters": {
     "cluster1": {
       "Destinations": {
         "cluster1/destination1": {
           "Address": "https://internal.domain.1.name.or.ip/"
         }
       }
     },
     "cluster2": {
       "Destinations": {
         "cluster2/destination1": {
           "Address": "https://internal.domain.2.name.or.ip/"
         }
       }
     }
   }
 }
}

Try it out and let me know how it goes.

[JeepNL]

Thank you for your answer. If I understand correctly, with the new Kestrel config feature in 5.0.0-RC1 I can configure YARP (also a Kestrel instance) to handle the TLS connections (SSL certs) for SNI/multiple domains (dotnet/aspnetcore#24286) and configure the routing in YARP as you described in your answer above/and by following the YARP Getting Started guide? From the comments in dotnet/runtime#30767 I know how to configure Kestrel to get an SSL Labs A+ score. I've 2 websites (prototypes / Preview 8) running with an A+ score, but now on 2 different VPS's because I stopped using NGINX.

I'm in no hurry, I can wait until RC1 is released, which will be next month I guess, as Preview 8 just has been released.

Below ( a top/down incoming traffic presentation) is what I want to achieve, a basic setup using one server (Ubuntu VPS) on which I'll be running 3 Kestrel instances. 1 for YARP en 2 for the different domains.

Internet
|
YARP: [example1.com] | [example2.com] (both ports 80/443)
|
Kestrel: Instance 1 [example1.com:51443] & Kestrel: Instance 2 [example2.com:52443]

(ports 51433, 52443 are just examples)

[Tratcher]

Sounds right.

[samsp-msft]

Should this get moved over to discussions?

[JeepNL]

@samsp-msft Oh right, I forgot about the 'discussions' option in GitHub. I should've created a discussion instead of an issue. Chris' answer and example answered what I wanted to know to get started with YARP, looking forward doing it actually, but I've to finish some other code I'm working on at the moment first. But as soon I've something to show, or maybe have another question, I'll certainly come back here (in discussions). So if you want you can close this issue and/or move it to discussions.

[JeepNL]

Hi @Tratcher,

This weekend I got finally some time free to experiment with YARP and to look into the links you provided and tried to setup YARP with Kestrel's SSL SNI feature so I can use multiple domains names on one server listening on one port.

My config: (Dev PC) Windows 10 Pro, Visual Studio Preview (latest) and (ASP).NET 6 Preview 3. (This YARP config is meant to run, eventually, on an Ubuntu 20.04 co-located VPS, which I'm using for my Blazor WASM sites).

YARP is listening on https://[::]:10443 and should proxy to https://production.localhost:5001 or https://beta.localhost:5002 depending on the host name. (all running on one dev PC.)

Here's my appsettings.Development.json (gist.github) appsettings.Development.json

I'm testing it with the 'production' url. It's a Kestrel Hosted Blazor WASM site listening on https://production.localhost:5001/

In YARP's command windows it says it's Proxying to https://production.localhost:5001/ but then there's this error: System.Net.Http.HttpRequestException: No such host is known. (production.localhost:5001)

YARP is unable to find the host, but the host is running.

When you look at the appsettings.Development.json gist, can you (perhaps, if you've got time for it, and I'm not in a hurry) see what I'm doing wrong?

Screenshot command window YARP's error messages":

Screenshot Browser YARP

The Blazor site is running at https://production.localhost:5001

Screenshot command window Kestrel Hosted Blazor WASM site (when I enter the url manually in the browser)

Screenshot Browser Blazor (when I enter the url manually in the browser)

[InteXX]

@Tratcher

Hm, it turns out I couldn't consolidate them.

With the first option, I get an exception when running on port 80:

fail: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
      An unhandled exception has occurred while executing the request.
      System.InvalidOperationException: StatusCode cannot be set because the response has already started.
         at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ThrowResponseAlreadyStartedException(String value)
         at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.set_StatusCode(Int32 value)
         at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.Microsoft.AspNetCore.Http.Features.IHttpResponseFeature.set_StatusCode(Int32 value)
         at Microsoft.AspNetCore.Http.DefaultHttpResponse.set_StatusCode(Int32 value)
         at Microsoft.AspNetCore.StaticFiles.StaticFileContext.ApplyResponseHeaders(Int32 statusCode)
         at Microsoft.AspNetCore.StaticFiles.StaticFileContext.SendAsync()
         at Microsoft.AspNetCore.StaticFiles.StaticFileContext.ServeStaticFile(HttpContext context, RequestDelegate next)
         at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
         at Program.<>c.<<<Main>$>b__0_5>d.MoveNext() in D:\Application\Server\Program.cs:line 66
      --- End of stack trace from previous location ---
         at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)
warn: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[2]
      The response has already started, the error page middleware will not be executed.
fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HMG7IBOT4FDN", Request id "0HMG7IBOT4FDN:00000002": An unhandled exception was thrown by the application.
      System.InvalidOperationException: StatusCode cannot be set because the response has already started.
         at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ThrowResponseAlreadyStartedException(String value)
         at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.set_StatusCode(Int32 value)
         at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.Microsoft.AspNetCore.Http.Features.IHttpResponseFeature.set_StatusCode(Int32 value)
         at Microsoft.AspNetCore.Http.DefaultHttpResponse.set_StatusCode(Int32 value)
         at Microsoft.AspNetCore.StaticFiles.StaticFileContext.ApplyResponseHeaders(Int32 statusCode)
         at Microsoft.AspNetCore.StaticFiles.StaticFileContext.SendAsync()
         at Microsoft.AspNetCore.StaticFiles.StaticFileContext.ServeStaticFile(HttpContext context, RequestDelegate next)
         at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
         at Program.<>c.<<<Main>$>b__0_5>d.MoveNext() in D:\Application\Program.cs:line 66
      --- End of stack trace from previous location ---
         at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)
         at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)
         at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)

... using this code:

    57.  app = builder.Build();
    58.  
    59.  app.Use(async (context, next) =>
    60.  {
    61.    if (context.Connection.LocalPort == 80)
    62.    {
    63.      context.Response.Headers["Content-Type"] = "text/html; charset=utf-8";
    64.      await context.Response.SendFileAsync(@"Pages\Static\Setup.htm");
    65.    }
==> 66.    await next();
    67.  });
    68.  
    69.  // Configure the HTTP request pipeline.
    70.  if (app.Environment.IsDevelopment())
    71.  {
    72.    app.UseWebAssemblyDebugging();
    73.  }
    74.  else
    75.  {
    76.    app.UseExceptionHandler("/Error");
    77.    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    78.    app.UseHsts();
    79.  }
    80.  
    81.  app.UseBlazorFrameworkFiles();
    82.  app.UseStaticFiles();
    83.  app.UseRouting();
    84.  app.MapRazorPages();
    85.  app.MapControllers();
    86.  app.MapFallbackToFile("index.html");
    87.  
    88.  app.Run();

... and with the second option, I get a compile-time error on HttpContext.Response:

An object reference is required for the non-static field, method, or property 'HttpContext.Response'

It isn't the end of the world—I can just split them out again—but I thought I'd let you know.

[Tratcher]

You're missing a return; after line 64, you don't want the pipeline to keep running, you've already sent the response.

You're right about the second one, that was sloppy, you need to get to the HttpContext. I think you can pass into the lambda?

[InteXX]

Fetish: I like my methods to be one-way-in, one-way-out. So I used this variation:

if (context.Connection.LocalPort == 80)
{
  context.Response.Headers["Content-Type"] = "text/html; charset=utf-8";
  await context.Response.SendFileAsync(@"Pages\Static\Setup.htm");
}
else 
{
  await next();
}

Works great.

pass into the lambda

Not sure I'm following you there. I tried app.MapGet("/", (context) => { ... }); but no luck.

[InteXX]

    74.  app.MapGet("/", (context) =>
    75.  {
    76.    context.Response.Headers["Content-Type"] = "text/html; charset=utf-8";
==> 77.    return File.ReadAllText(@"Pages\Setup.htm");
    78.  }).RequireHost("*:80");

Cannot implicitly convert type 'string' to 'System.Threading.Tasks.Task' 77
Cannot convert lambda expression to intended delegate type because some of the return types in the block are not implicitly convertible to the delegate return type 77

[InteXX]

OK, we have to cast the context parameter:

74.  app.MapGet("/", (HttpContext context) =>
75.  {
76.    context.Response.Headers["Content-Type"] = "text/html; charset=utf-8";
77.    return File.ReadAllText(@"Pages\Setup.htm");
78.  }).RequireHost("*:80");

https://docs.microsoft.com/en-us/aspnet/core/fundamentals/http-context?view=aspnetcore-6.0#use-httpcontext-from-minimal-apis

All is right with the world.