Tutorial: Using Apache as a reverse proxy and load balancer for Tomcat

Four variations on the same idea: put Apache in front of a Java application so it can terminate TLS, handle the redirect from HTTP to HTTPS, restrict access by source IP, and (in the last case) spread traffic across more than one Tomcat instance instead of just passing it through to one, as a gist:

Worth walking through what each config adds over the last.

config_http is the simple case: a plain proxy to a single backend, no TLS involved yet. config_https adds the redirect from HTTP to HTTPS and terminates TLS at Apache, so the connection to Tomcat behind it stays plain HTTP on the internal network; SSLProtocol -All ... +TLSv1 +TLSv1.1 +TLSv1.2 is an explicit allowlist rather than a denylist, which is safer against whatever comes after this list was written, since new insecure protocol versions don't get added to an allowlist by default.

retrict_access_by_IP (typo in the original filename, kept as-is) layers on an Order Deny,Allow block that restricts the proxy to a short list of source IPs, useful for an internal or partner-only endpoint that still needs to sit behind the same TLS termination as everything else.

apache_proxy_server is the full load-balanced case, spreading traffic across a Tomcat cluster. The route= tags on each BalancerMember and the ROUTEID cookie are what make this sticky: once a client lands on route=1, the cookie sends every subsequent request from that client back to the same backend. That matters for anything holding session state in memory on the Tomcat side rather than in a shared store. It's also the tradeoff to know about: sticky sessions mean losing a backend loses every session pinned to it, which is fine for a lot of applications and a real availability problem for others.