Cheatsheet Apache

# Debian/Ubuntu:
/etc/apache2/apache2.conf
/etc/apache2/sites-available/
/etc/apache2/ports.conf

# CentOS/RHEL:
/etc/httpd/conf/httpd.conf
/etc/httpd/conf.d/

Localização dos configs.

apachectl configtest  # testar config
apachectl graceful    # reload suave
systemctl restart apache2
systemctl status apache2

a2ensite site.conf  # ativar site
a2dissite site.conf  # desativar
a2enmod rewrite     # ativar módulo

Gerir o serviço.

a2enmod rewrite     # URL rewrite
a2enmod ssl        # HTTPS
a2enmod headers    # headers custom
a2enmod proxy      # reverse proxy
a2enmod proxy_http  # proxy HTTP
a2enmod expires    # cache headers

Ativar funcionalidades.

ServerRoot "/etc/apache2"
Listen 80
Listen 443

DocumentRoot "/var/www/html"
ServerName exemplo.com
ServerAdmin admin@exemplo.com

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

Configuração global.

<VirtualHost *:80>
  ServerName exemplo.com
  ServerAlias www.exemplo.com
  DocumentRoot /var/www/exemplo

  <Directory /var/www/exemplo>
    AllowOverride All
    Require all granted
  </Directory>
</VirtualHost>

Configurar domínio.

<VirtualHost *:80>
  ServerName app1.com
  DocumentRoot /var/www/app1
</VirtualHost>

<VirtualHost *:80>
  ServerName app2.com
  DocumentRoot /var/www/app2
</VirtualHost>

Vários domínios no mesmo servidor.

<Directory /var/www/app>
  Options -Indexes +FollowSymLinks
  AllowOverride All
  Require all granted
</Directory>

<Directory /var/www/app/private>
  Require ip 192.168.1.0/24
</Directory>

Controlar acesso por pasta.

Alias /docs /var/www/documentacao

<Directory /var/www/documentacao>
  Require all granted
</Directory>

# Aceder em: exemplo.com/docs/

Mapear caminhos.

# .htaccess na raiz do projeto
RewriteEngine On

# Redirecionar para HTTPS:
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Config por diretório.

# Cache de estáticos:
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpeg "access plus 1 month"
  ExpiresByType text/css "access plus 1 week"
  ExpiresByType application/javascript "access plus 1 week"
</IfModule>

# Gzip:
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html
  AddOutputFilterByType DEFLATE text/css
  AddOutputFilterByType DEFLATE application/json
</IfModule>

Performance.

RewriteEngine On
RewriteBase /
RewriteRule ^index\.html$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.html [L]

Frontend routing.

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# Ou no public/.htaccess:
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]

Routing para PHP.

# Bloquear acesso a ficheiros:
<FilesMatch "\.(env|gitignore|md)$">
  Require all denied
</FilesMatch>

# Proteger .git:
RedirectMatch 404 /\.git

# Desativar listagem:
Options -Indexes

Segurança via .htaccess.

RewriteRule Pattern Substitution [Flags]

# Flags comuns:
[L]    # Last (parar aqui)
[R=301] # Redirect permanente
[R=302] # Redirect temporário
[NC]   # No Case (ignorar maiúsculas)
[QSA]  # Query String Append

Estrutura das regras.

# Condições (antes da Rule):
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/api/

Condições para regras.

# Remover www:
RewriteCond %{HTTP_HOST} ^www\.(.*)$
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

# URL amigável:
RewriteRule ^produto/([0-9]+)$ produto.php?id=$1 [L]

# Remover .html:
RewriteRule ^([^\.]+)$ $1.html [L]

Casos de uso comuns.

# Redirect simples:
Redirect 301 /antigo /novo
RedirectMatch 301 ^/blog/(.*)$ /artigos/$1

# Redirect com Rewrite:
RewriteRule ^/velho/(.*)$ /novo/$1 [R=301,L]

# Redirect condicional:
RewriteCond %{HTTP_HOST} ^old\.com$
RewriteRule ^(.*)$ https://new.com/$1 [R=301,L]

Redirecionamentos.

<VirtualHost *:443>
  ServerName exemplo.com
  SSLEngine on
  SSLCertificateFile /etc/ssl/cert.pem
  SSLCertificateKeyFile /etc/ssl/key.pem

  SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
  SSLCipherSuite HIGH:!aNULL:!MD5
</VirtualHost>

Configurar TLS.

Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security \
  "max-age=31536000; includeSubDomains"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Proteção HTTP headers.

# httpd.conf / apache2.conf:
ServerTokens Prod
ServerSignature Off

# Remover header de versão:
Header unset X-Powered-By

# Desativar TRACE:
TraceEnable Off

Minimizar exposição.

# Auth básica:
<Directory /var/www/admin>
  AuthType Basic
  AuthName "Área Restrita"
  AuthUserFile /etc/apache2/.htpasswd
  Require valid-user
</Directory>

# Criar: htpasswd -c .htpasswd user

Autenticação por pasta.

a2enmod proxy proxy_http

<VirtualHost *:80>
  ServerName app.exemplo.com
  ProxyPreserveHost On
  ProxyPass / http://127.0.0.1:3000/
  ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>

Proxy para Node/Python.

a2enmod proxy_wstunnel

ProxyPass /ws ws://127.0.0.1:8080/ws
ProxyPassReverse /ws ws://127.0.0.1:8080/ws

# Ou com Rewrite:
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteRule /ws/(.*) ws://127.0.0.1:8080/$1 [P,L]

Suporte a WebSockets.

# /etc/apache2/mods-available/mpm_event.conf
<IfModule mpm_event_module>
  StartServers 4
  MinSpareThreads 25
  MaxSpareThreads 75
  ThreadLimit 64
  ThreadsPerChild 25
  MaxRequestWorkers 150
  MaxConnectionsPerChild 0
</IfModule>

Tuning de processos.

# Nível de log:
LogLevel warn  # debug, info, notice, warn, error

# Ver config ativa:
apachectl -S  # virtual hosts
apachectl -M  # módulos ativos
apachectl -t -D DUMP_VHOSTS

# Log personalizado:
LogFormat "%h %l %u %t \"%r\" %>s %b" common

Diagnóstico e logging.