Batch 4: Cloud Ansible AWS & Azure Docker & Podman Apache & NGINX ← Full TOC

🪶 Apache Configuration — VirtualHost, .htaccess, mod_rewrite, SSL, CGI

Apache HTTP Server is the world's most-used web server. Configuration is done through .conf files and .htaccess files. Apache modules extend functionality — mod_rewrite for URL rewriting, mod_ssl for HTTPS, mod_cgid for CGI scripts.

📋 Reference

Item	Syntax	Description
ServerName	ServerName www.mywebuniversity.com	Primary hostname for virtual host
ServerAlias	ServerAlias mywebuniversity.com	Additional hostnames
DocumentRoot	DocumentRoot /var/www/React/prod	Directory serving files
VirtualHost	<VirtualHost *:80> ... </VirtualHost>	Virtual host container — one per site
Directory	<Directory /path> Options... </Directory>	Configure access for a directory
Options	Options +ExecCGI -Indexes +FollowSymLinks	Enable/disable directory features
AllowOverride	AllowOverride All / None / FileInfo	What .htaccess can override
Require	Require all granted / Require ip 192.168	Access control
ScriptAlias	ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/	Map URL to CGI directory
AddHandler	AddHandler cgi-script .cgi .py	Mark file extensions as CGI
ErrorLog	ErrorLog ${APACHE_LOG_DIR}/error.log	Error log location
CustomLog	CustomLog ${APACHE_LOG_DIR}/access.log combined	Access log location
LogLevel	LogLevel warn / info / debug	Logging verbosity
a2ensite	a2ensite mysite.conf	Enable site config
a2dissite	a2dissite 000-default.conf	Disable site config
a2enmod	a2enmod rewrite ssl headers	Enable Apache module
a2dismod	a2dismod autoindex	Disable Apache module
apachectl	apachectl -t / apachectl graceful	Test config / graceful restart
mod_rewrite	RewriteEngine On / RewriteRule / RewriteCond	URL rewriting engine
RewriteRule	RewriteRule ^old/(.*)$ /new/$1 [R=301,L]	URL rewrite/redirect rule
RewriteCond	RewriteCond %{HTTPS} off	Condition for rewrite rule
mod_ssl	SSLEngine on / SSLCertificateFile / SSLCertificateKeyFile	HTTPS with SSL/TLS
SSLCertificateFile	SSLCertificateFile /etc/letsencrypt/live/domain/fullchain.pem	TLS certificate
SSLCertificateKeyFile	SSLCertificateKeyFile /etc/letsencrypt/live/domain/privkey.pem	TLS private key
Header	Header always set X-Frame-Options DENY	Set HTTP response headers
mod_deflate	AddOutputFilterByType DEFLATE text/html text/css	Gzip compression
mod_expires	ExpiresActive On / ExpiresDefault 'access plus 1 week'	Browser caching headers
ProxyPass	ProxyPass /api/ http://localhost:3000/	Reverse proxy to backend
ProxyPassReverse	ProxyPassReverse /api/ http://localhost:3000/	Fix redirects in proxy response

💡 Example

# /etc/apache2/sites-available/mywebuniversity.conf
# Enable: sudo a2ensite mywebuniversity && sudo systemctl reload apache2

<VirtualHost *:80>
    ServerName  www.mywebuniversity.com
    ServerAlias mywebuniversity.com

    # Redirect HTTP to HTTPS
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]

    # Log files
    ErrorLog  ${APACHE_LOG_DIR}/mywebuniversity_error.log
    CustomLog ${APACHE_LOG_DIR}/mywebuniversity_access.log combined
</VirtualHost>

<VirtualHost *:443>
    ServerName  www.mywebuniversity.com
    ServerAlias mywebuniversity.com
    DocumentRoot /var/www/React/prod

    # SSL Configuration
    SSLEngine                on
    SSLCertificateFile       /etc/letsencrypt/live/mywebuniversity.com/fullchain.pem
    SSLCertificateKeyFile    /etc/letsencrypt/live/mywebuniversity.com/privkey.pem

    # Modern TLS only
    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder     off
    SSLSessionTickets       off

    # Security headers
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set X-Frame-Options DENY
    Header always set X-Content-Type-Options nosniff
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

    # Document root
    <Directory /var/www/React/prod>
        Options +ExecCGI -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # CGI Scripts — each language chapter
    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory /usr/lib/cgi-bin/>
        Options +ExecCGI
        AddHandler cgi-script .cgi .py
        Require all granted
    </Directory>

    # Caching static assets
    <FilesMatch "\.(ico|jpg|jpeg|png|gif|svg|css|js|woff2)$">
        Header set Cache-Control "max-age=2592000, public"
    </FilesMatch>

    # Compression
    <IfModule mod_deflate.c>
        AddOutputFilterByType DEFLATE text/html text/plain text/css
        AddOutputFilterByType DEFLATE application/javascript application/json
    </IfModule>

    # Reverse proxy to Node.js API
    ProxyPreserveHost On
    ProxyPass        /api/ http://127.0.0.1:3000/ retry=1 timeout=60
    ProxyPassReverse /api/ http://127.0.0.1:3000/

    # Custom error pages
    ErrorDocument 404 /404.html
    ErrorDocument 500 /500.html

    ErrorLog  ${APACHE_LOG_DIR}/mywebuniversity_ssl_error.log
    CustomLog ${APACHE_LOG_DIR}/mywebuniversity_ssl_access.log combined
</VirtualHost>

# ── Enable required modules ────────────────────────────────────
# sudo a2enmod rewrite ssl headers proxy proxy_http deflate expires cgid
# sudo a2ensite mywebuniversity.conf
# sudo a2dissite 000-default.conf
# sudo apache2ctl -t  # test config
# sudo systemctl reload apache2

# ── Let's Encrypt TLS ─────────────────────────────────────────
# sudo apt install certbot python3-certbot-apache
# sudo certbot --apache -d www.mywebuniversity.com -d mywebuniversity.com
# sudo certbot renew --dry-run  # test auto-renewal

🏠 Index | NGINX Configuration →