IPv6 at w.ods.org

How to make it work ?

To set up an IPv6 web site, you need 3 important things :

an IPv6 enabled ISP. In France, Nerim (http://www.nerim.net/) automatically provides a /48 prefix for free if you already have a static IPv4 address. This means you can install 65536 networks at home !!!
an IPv6 enabled domain server. www.ods.org hosts the names w.ods.org and w6.ods.org, and supports AAAA fields.
an IPv6 enabled web server or reverse-proxy. Since w.ods.org runs on Apache through a reverse-proxy based on haproxy, I had to extend this last one to support IPv6 (on the client side only for the moment).

The reverse proxy approach has several advantages :

only the front firewall has to support IPv6, the backend one can be a different techno;
the solution is independant from the web server. I know I can still upgrade apache without the fear that the IPv6 patches won't apply anymore.

The downside of this solution is that the reverse-proxy has to rewrite several headers which could contain 128bits addresses not understood by a pure IPv4 web server. For example, I had to replace [2001:7a8:363c:.*] with w6.ods.org in the Host and Referer fields.

Architectural overview

The IPv4 client comes from the internet and tries to connect to the
firewall's address, which is redirected to the reverse proxy by address
translation.
The IPv6 client comes from the internet through the external firewall
which lets HTTP/IPv6 traffic reach the reverse proxy. There is no translation
here since each host can have its own address.
The reverse proxy, bound to IPv4 and IPv6 addresses handles the request,
rewrites what needs to be modified and forwards it to the Apache web server
using the IPv4 protocol.