As of Apache 2.4.5, `mod_proxy_wstunnel` is available, which (of course) requires `mod_proxy`: https://httpd.apache.org/docs/2.4/mod/mod_proxy_wstunnel.html

This module is part of recent Debian/Ubuntu packages, so you should be able to just `a2enmod proxy_wstunnel && systemctl restart apache2` before continuing. For other platforms, use whatever magic you normally would use to check if a module is available and enabled.

Your Apache configuration should already have this:

```
RewriteEngine on
RewriteRule ^(.*)$          /index.php?__path__=$1  [B,L,QSA]
```

Change it to this (and restart Apache):

```
RewriteEngine on
RewriteCond %{REQUEST_URI}  ^/ws/
RewriteCond %{QUERY_STRING} transport=websocket
RewriteRule /(.*)           ws://localhost:22280/$1 [B,P,L]
RewriteRule ^(.*)$          /index.php?__path__=$1  [B,L,QSA]
```

As the doc at https://secure.phabricator.com/book/phabricator/article/notifications/#terminating-ssl-with-ngi says, configure your Phabricator accoridngly. Everything should now "just work". Close off port 22280 on your firewall, grab a beverage, and relax.