Running the Apache web server in front of Philter can have a few benefits. You can use Apache’s authentication mechanisms to have greater control over who can reach Philter’s API, terminate TLS at Apache, and use Apache’s logs for access statistics.
This guide sets that up on a Philter 4.0 marketplace virtual machine, which runs Ubuntu. Apache serves HTTPS on port 443 and passes requests to Philter on the same host. Philter itself then serves plain HTTP, so it must listen only on the local interface: the redaction API carries the sensitive text you are redacting.
1. Point Philter at localhost and turn off its TLS
Add one setting to /opt/philter/.env, and bind Philter’s port to the local interface in its compose file:
echo 'SSL_ENABLED=false' | sudo tee -a /opt/philter/.env
sudo sed -i 's/- "8080:8080"/- "127.0.0.1:8080:8080"/' /opt/philter/docker-compose.yaml
sudo systemctl restart philter
Philter now answers plain HTTP on 127.0.0.1:8080 and nothing else can reach that port. Check it from the virtual machine:
curl http://127.0.0.1:8080/api/health
2. Install Apache
sudo apt-get update
sudo apt-get install -y apache2
sudo a2enmod ssl proxy proxy_http
3. Add your certificate
Put the certificate and private key for your host name on the virtual machine. This guide uses philter.mydomain.com:
/etc/ssl/certs/philter.mydomain.com.crt, with any intermediate certificates appended after it/etc/ssl/private/philter.mydomain.com.key, readable only by root
4. Configure the proxy
Create /etc/apache2/sites-available/philter.conf:
<VirtualHost *:443>
ServerName philter.mydomain.com
SSLEngine on
SSLCertificateFile /etc/ssl/certs/philter.mydomain.com.crt
SSLCertificateKeyFile /etc/ssl/private/philter.mydomain.com.key
ProxyPreserveHost On
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
LogLevel warn
ErrorLog ${APACHE_LOG_DIR}/philter.mydomain.com-error.log
CustomLog ${APACHE_LOG_DIR}/philter.mydomain.com-access.log combined
</VirtualHost>
Enable the site, check the configuration, and reload Apache:
sudo a2ensite philter
sudo apache2ctl configtest
sudo systemctl reload apache2
Apache passes each request’s Authorization header through, so clients send their Philter API key exactly as before.
5. Update the firewall
In the virtual machine’s security group or network security group, open port 443 to the networks that call Philter, and close port 8080, which is no longer used from outside.
6. Verify
From a client, check Philter through Apache, then redact some text with your API key:
curl https://philter.mydomain.com/api/health
curl "https://philter.mydomain.com/api/filter" \
-H "Authorization: Bearer $PHILTER_API_KEY" \
-H "Content-Type: text/plain" \
--data-binary "George Washington was a patient and his SSN is 123-45-6789."
{{{REDACTED-name}}} was a patient and his SSN is {{{REDACTED-ssn}}}.
To keep Philter serving HTTPS itself instead, give it a signed certificate; see using a signed SSL certificate with Philter.