This question was originally asked about Mac OS X Server 4.1, but as software version numbers have moved on, and I just now got this working, this answer is written as of macOS Server 5.2. Server 5 apparently changes things a bit in that every service in Server is now behind one master reverse proxy, so these instructions will not work with Server 4.1.
Configuration Files
Make web app configuration file on the macOS Server machine, in /Library/Server/Web/Config/apache2/httpd_site2webapp.conf, pointing at the IP address of the site2 server.
ProxyPreserveHost On
ProxyPassReverse / http://192.168.1.15:80/
ProxyPass / http://192.168.1.15:80/
ServerName site2.example.com
Then in /Library/Server/Web/Config/apache2/webapps/com.example.site2webapp.plist, add the following, referencing the location of the .conf file above:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- See man pages for webapp.plist(5) and webappctl(8) for information about this example webapp.plist -->
<plist version="1.0">
<dict>
<key>includeFiles</key>
<array> <!-- Include files are activated in virtual host when webapp is started -->
<string>/Library/Server/Web/Config/apache2/httpd_site2webapp.conf</string>
</array>
<key>name</key>
<string>com.example.site2webapp</string>
<key>displayName</key> <!-- Name shown in Server app -->
<string>site2WebApp</string>
<key>installationIndicatorFilePath</key> <!-- The presence of this file indicates web app is installed -->
<string>/Library/Server/Web/Config/apache2/httpd_site2webapp.conf</string>
<key>sslPolicy</key><!-- Determines webapp SSL behavior -->
<integer>0</integer> <!-- 0: default, UseSSLWhenEnabled -->
<!-- 1: UseSSLAlways -->
<!-- 2: UseSSLOnlyWhenCertificateIsTrustable -->
<!-- 3: UseSSLNever -->
<!-- 4: UseSSLAndNonSSL -->
</dict>
</plist>
If you also need SSL, also put the following in /Library/Server/Web/Config/apache2/httpd_site2SSLwebapp.conf. The config differs in that LAN traffic between the servers will be unencrypted by default (this config essentially tells Server not to check if there is a valid cert), but the WAN traffic will be encrypted. I believe you can install a self-signed certificate on the site2 server for encrypted local traffic, but this config will still enable the reverse proxy without having to have matching certificates. (I grant there is likely a more correct way to secure the local traffic, but this worked for me.)
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyPreserveHost On
ProxyPassReverse / http://192.168.1.15:80/
ProxyPass / http://192.168.1.15:80/
ServerName site2.example.com
And the corresponding SSL web app plist, /Library/Server/Web/Config/apache2/webapps/com.example.site2SSLwebapp.plist, much the same as above:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- See man pages for webapp.plist(5) and webappctl(8) for information about this example webapp.plist -->
<plist version="1.0">
<dict>
<key>includeFiles</key>
<array> <!-- Include files are activated in virtual host when webapp is started -->
<string>/Library/Server/Web/Config/apache2/httpd_site2SSLwebapp.conf</string>
</array>
<key>name</key>
<string>com.example.site2SSLwebapp</string>
<key>displayName</key> <!-- Name shown in Server app -->
<string>site2SSLWebApp</string>
<key>installationIndicatorFilePath</key> <!-- The presence of this file indicates web app is installed -->
<string>/Library/Server/Web/Config/apache2/httpd_site2SSLwebapp.conf</string>
<key>sslPolicy</key><!-- Determines webapp SSL behavior -->
<integer>0</integer> <!-- 0: default, UseSSLWhenEnabled -->
<!-- 1: UseSSLAlways -->
<!-- 2: UseSSLOnlyWhenCertificateIsTrustable -->
<!-- 3: UseSSLNever -->
<!-- 4: UseSSLAndNonSSL -->
</dict>
</plist>
For each of these four files, the permissions need to be owner: root and group: wheel, 644:
$ sudo chown -R root:wheel /path/to/file
$ sudo chmod -R 644 /path/to/file
Setting up Server.app
Add the web app to Websites
- In the Websites tab of the Server.app interface, click the + below the Websites listing to add a new site
- Enter
site2.example.com for Domain Name
- Leave everything else at the default settings
- Click Edit Advanced Settings…
- Under the section “Make these web apps available on this website:” check Enable for site2WebApp
- Click OK
- Click Create
SSL
If you need SSL on the WAN, install a certificate in Server that covers the new domain. I used Let’s Encrypt to create a single certificate that was good for both my site1 and site2 domains.
- In the Certificates tab of Server.app, click the + at the bottom of the window, then Import a Certificate Identity…
- Drag-and-drop the
.pem files you got back from Let's Encrypt (or whatever certificate files you have), and click Import
- In the Websites tab, create the new site almost the same as before, except change the Port to
443 and under SSL Certificate, pick the cert you just imported
- Under Edit Advanced Settings…, instead check Enable for site2SSLWebApp
My answer above is adapted from the instructions found at https://www.precursor.ca/precursor/resources/rais/landing/ReverseProxyTutorial.html. Warning: this link downloads a zip file with PDF and sample Server web app config files. Their zip also includes historical instructions for doing this with Server 4.1.
