apache

Identity

• Unit: apache2.service (Debian/Ubuntu), httpd.service (RHEL/Fedora/CentOS)
• Config (Debian): /etc/apache2/apache2.conf, /etc/apache2/sites-available/, /etc/apache2/sites-enabled/, /etc/apache2/mods-available/, /etc/apache2/mods-enabled/, /etc/apache2/conf-available/
• Config (RHEL): /etc/httpd/httpd.conf, /etc/httpd/conf.d/, /etc/httpd/conf.modules.d/
• Logs: journalctl -u apache2 / journalctl -u httpd, /var/log/apache2/ (Debian), /var/log/httpd/ (RHEL)
• User: www-data (Debian/Ubuntu), apache (RHEL/Fedora)
• Distro install: apt install apache2 / dnf install httpd

Key Operations

Expected State

• Ports: 80/tcp (HTTP), 443/tcp (HTTPS)
• Verify: ss -tlnp | grep ':80\|:443'
• Firewall (Debian): sudo ufw allow 'Apache Full' or sudo ufw allow 80,443/tcp
• Firewall (RHEL): sudo firewall-cmd --add-service=http --add-service=https --permanent && sudo firewall-cmd --reload
• Loaded modules: Verify with apache2ctl -M — expect ssl_module, rewrite_module for typical setups

Health Checks

1. systemctl is-active apache2 (or httpd) → active
2. sudo apachectl configtest 2>&1 → contains Syntax OK
3. curl -sI http://localhost → HTTP response (not connection refused)
4. ss -tlnp | grep ':80\|:443' → apache2 or httpd listed

Common Failures

Pain Points

• Debian vs RHEL config layout: Debian uses a2ensite/a2enmod with sites-available/ + sites-enabled/ symlinks and separate mods-available/. RHEL puts everything in conf.d/ with no enable/disable tooling — you manage files directly.
• .htaccess performance cost: Every request traverses all parent directories looking for .htaccess files when AllowOverride is anything but None. On high-traffic sites this is measurable overhead. Prefer AllowOverride None and put directives in the VirtualHost block directly.
• ServerName ordering and default vhost selection: Apache picks the first VirtualHost that matches the requested IP:port if no ServerName matches. Unlike nginx, there is no explicit default_server flag — the first defined vhost on a given port becomes the default. File load order (alphabetical in conf.d/ and sites-enabled/) determines which is first.
• MPM selection (prefork vs worker vs event): prefork is required for mod_php but is single-threaded per process and memory-heavy. worker is multi-threaded but incompatible with non-thread-safe PHP. event (the default in modern Apache) is the best choice with PHP-FPM. Check with apache2ctl -V | grep MPM.
• mod_php vs PHP-FPM: mod_php embeds PHP into Apache (requires prefork MPM, loads PHP for every request including static files). PHP-FPM via mod_proxy_fcgi uses a separate process pool, works with event MPM, and lets you run multiple PHP versions. Prefer PHP-FPM for new deployments.
• Graceful vs immediate restart: systemctl reload apache2 sends SIGUSR1 (graceful restart) — existing requests finish before workers restart. systemctl restart apache2 sends SIGTERM, immediately killing all connections. Use reload for production config changes.
• SELinux on RHEL: If files have correct Unix permissions but Apache still gets Permission denied, SELinux is likely the cause. Check with ausearch -c httpd --raw | audit2allow and fix with chcon -t httpd_sys_content_t or a custom policy.

References

See references/ for:

• httpd.conf.annotated — complete server config and VirtualHost blocks with every directive explained
• common-patterns.md — VirtualHost, SSL, reverse proxy, PHP-FPM, htpasswd, rewrites, and static file examples
• docs.md — official documentation links