Challenge 2: Password-Reset Links Pointing at the Internal Backend
Address — Solution Walkthrough

What's causing it:

By default, Apache forwards the Host header from the ProxyPass
target URL itself -- in this case "10.0.0.11:5000" -- rather than the
Host header the original client actually sent (the real public
domain). The backend application, when it builds an absolute URL for
the password-reset email, has no way to know the real public domain
was ever involved -- as far as it can tell from the Host header it
received, "10.0.0.11:5000" IS the site's address, so that's what ends
up baked into the generated link.

How to fix it:

Add ProxyPreserveHost On to the relevant VirtualHost or Proxy
configuration. This changes what Host header Apache forwards to the
backend -- instead of substituting the proxy target's own address, it
passes the client's original Host header through unchanged. Once
enabled, the backend sees the real public domain the client actually
requested, and any absolute URLs it builds (like the password-reset
link) will correctly use that domain instead of the internal backend
address.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader can connect a real, plausible
symptom (a broken-looking link in an email) back to its actual root
cause (the default Host-header-forwarding behavior), and knows the
specific directive that fixes it -- exactly the kind of gotcha this
chapter's warning box exists to prevent.