# Ansible managed
#
# -FrontPage- version=5.0
######################################################
# Apache 2.4 Configration for VUX x86_64
######################################################
ServerRoot /usr/services/vux/apache
DocumentRoot /usr/services/vux/apache/htdocs
PidFile /run/httpd.pid
ScriptSock /run/cgid.sock
CoreDumpDirectory /var
# These are bad in conjunction with NFS
EnableSendfile Off
EnableMMAP Off
User www
Group www
ServerName prod-iad-vuxweb1501b
ServerSignature Off
ServerTokens Prod
MaxRequestsPerChild 8192
# HOSTINGDEV-5525: event MPM limits in conf/extra/httpd-mpm.conf (bundle hosts only)
Include conf/extra/httpd-mpm.conf
#ThreadsPerChild 50
#ServerLimit 64
TimeOut 20
KeepAlive On
MaxKeepAliveRequests 250
KeepAliveTimeout 3
Listen 80
Listen 443
LoadModule unixd_module modules/mod_unixd.so
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbd_module modules/mod_authn_dbd.so
LoadModule fcgid_module modules/mod_fcgid.so
#LoadModule authn_default_module modules/mod_authn_default.so
#LoadModule authz_default_module modules/mod_authz_default.so
# mod_auth*_default is deprecated in 2.4 replaced with
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule access_compat_module modules/mod_access_compat.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule dbd_module modules/mod_dbd.so
LoadModule dumpio_module modules/mod_dumpio.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule include_module modules/mod_include.so
LoadModule filter_module modules/mod_filter.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
LoadModule headers_module modules/mod_headers.so
#LoadModule ident_module modules/mod_ident.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule asis_module modules/mod_asis.so
LoadModule info_module modules/mod_info.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule cgid_module modules/mod_cgid.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
#LoadModule imagemap_module modules/mod_imagemap.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule auth_pam_module modules/mod_auth_pam.so
#LoadModule pagespeed_module modules/mod_pagespeed.so
#LoadModule rpaf_module modules/mod_rpaf.so
# mod_rpaf is not compatible with 2.4
# https://syslint.com/blog/tutorial/replacing-mod_rpaf-with-mod_remoteip-in-apache-2-4-nginx-real_ip-problem-solution/
LoadModule remoteip_module modules/mod_remoteip.so
# mod_proxy_fcgi does not support these parameters
FcgidProcessLifeTime 30
FcgidIdleTimeout 40
FcgidMaxRequestLen 104857600
FcgidMaxProcesses 4000
# mod_remoteip does not support these commands
#RPAFenable On
#RPAFproxy_ips 127.0.0.1 1 2 7 . 0 . 0 . 1 1 0 . 3 0 . 7 2 . 4
#RPAFsethostname On
#RPAFheader X-Real-Ip
# replaced with:
RemoteIPHeader X-Forwarded-For
#RemoteIPInternalProxy 127.0.0.1
#RemoteIPInternalProxy 10.30.7 2.4
ProxyPreserveHost On
# Disable TRACE method
TraceEnable off
SetHandler server-status
# apache 2.4 equivalent of Order Deny,Allow / Deny from all / Allow from ...
Require ip 127.0.0.1
Require ip 10.
Options FollowSymLinks ExecCGI IncludesNOEXEC Indexes
AllowOverride All
ErrorDocument 401 /data/templates/http-errors/Error-401.htm
ErrorDocument 403 /data/templates/http-errors/Error-403.htm
ErrorDocument 404 /data/templates/http-errors/Error-404.htm
ErrorDocument 500 /data/templates/http-errors/Error-500.htm
UserDir .
Options Indexes
AllowOverride All
AllowOverride All
Options ExecCGI
DirectoryIndex index.php4 index.php3 index.php index.phtml index.xml index.html index.htm index.shtml index.shtm home.php home.htm home.html default.htm default.html welcome.htm welcome.html
AccessFileName .htaccess-ic .htaccess
#Order allow,deny
#Deny from all
Require all denied
#Order allow,deny
#Deny from all
Require all denied
#Order allow,deny
#Deny from all
Require all denied
UseCanonicalName On
TypesConfig /usr/services/vux/apache/conf/mime.types
#DefaultType text/plain
MIMEMagicFile /usr/services/vux/apache/conf/magic
HostnameLookups Off
ErrorLogFormat "%{Host}i [%t] [%l] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"
#ErrorLog /var/log/httpd_error_log
ErrorLog "|/usr/bin/rtclient -e 10.45.129.223 5145"
#ErrorLog "||/usr/services/vux/apache/bin/rotatelogs -l /data/logs/vux/prod-iad-vuxweb1501b/error_log.%Y-%m-%d-%H 3600"
LogLevel warn
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Host}i %b" bandwidth
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
Alias /data/ /data/
#Alias /icons/ "/usr/services/vux/apache/icons/"
#
#Options Indexes MultiViews
#AllowOverride None
#Order allow,deny
#Allow from all
#
ScriptAlias /cgi-bin/ "/usr/services/vux/apache/cgi-bin/"
AllowOverride None
Options ExecCGI
#Order allow,deny
#Allow from all
Require all granted
IndexOptions FancyIndexing
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*
AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core
AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif README
AddIcon /icons/folder.gif ^^DIRECTORY^^
AddIcon /icons/blank.gif ^^BLANKICON^^
DefaultIcon /icons/unknown.gif
ReadmeName README
HeaderName HEADER
IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
AddEncoding x-compress Z
AddEncoding x-gzip gz tgz
AddLanguage da .dk
AddLanguage nl .nl
AddLanguage en .en
AddLanguage et .ee
AddLanguage fr .fr
AddLanguage de .de
AddLanguage el .el
AddLanguage it .it
AddLanguage ja .ja
AddCharset ISO-2022-JP .jis
AddLanguage pl .po
AddCharset ISO-8859-2 .iso-pl
AddLanguage pt .pt
AddLanguage pt-br .pt-br
AddLanguage ltz .lu
AddLanguage ca .ca
AddLanguage es .es
AddLanguage sv .se
AddLanguage cz .cz
LanguagePriority en da nl et fr de el it ja pl pt pt-br ltz ca es sv
AddType application/x-tar .tgz
IdleTimeout 45
IdleScanInterval 5
BusyTimeout 120
BusyScanInterval 120
ErrorScanInterval 3
ZombieScanInterval 3
ProcessLifeTime 300
SharememPath /run/fcgid.shm
SocketPath /run/fcgid.sock
MaxProcessCount 700
MaxRequestsPerProcess 2000
DefaultMaxClassProcessCount 15
DefaultMinClassProcessCount 0
IPCCommTimeout 90
AddType text/html .shtml
AddHandler server-parsed .shtml
AddType text/html .shtm
AddHandler server-parsed .shtm
AddType text/x-component .htc
BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "MSIE 6" force-no-vary
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0
SetEnvIfNoCase X-Forwarded-Proto https HTTPS=on
# Enable/Disable mod_pagespeed.
# By default, this is disabled. It can be enabled via .htaccess.
ModPagespeed off
# Direct Apache to send all HTML output to the mod_pagespeed
# output handler.
AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER text/html
# If you want mod_pagespeed process XHTML as well, please uncomment this
# line.
# AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER application/xhtml+xml
ModPagespeedFileCachePath "/var/mod_pagespeed/cache/"
ModPagespeedRewriteLevel CoreFilters
ModPagespeedImageMaxRewritesAtOnce 12
ModPagespeedMaxSegmentLength 250
ModPagespeedAvoidRenamingIntrospectiveJavascript on
ModPagespeedStatistics on
ModPagespeedMessageBufferSize 100000
RLimitCPU 128 256
RLimitMEM 201326592 301989888
RLimitNProc 2048 2048
UseCanonicalName Off
LogFormat "%{Host}i %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcommon
# HOSTINGDEV-4243
SetEnvIf X-Forwarded-For "^\\s*([^,\\s]+)" CLIENT_IP=$1 HAVE_CLIENT_IP
Header set CLIENT-IP "%{CLIENT_IP}e" env=HAVE_CLIENT_IP
Header set CLIENT-IP "%{REMOTE_ADDR}e" env=!HAVE_CLIENT_IP
# END
LogFormat "%{Host}i %b %{CLIENT_IP}e %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" rtformat
CustomLog "|/usr/bin/rtclient -a 10.45.129.223 5145" rtformat
CustomLog "||/usr/services/vux/apache/bin/rotatelogs -l /data/logs/vux/prod-iad-vuxweb1501b/access_log.%Y-%m-%d-%H%M 900" rtformat
CustomLog "||/usr/services/vux/apache/bin/rotatelogs -l /data/logs/prod-iad-vuxweb1501b-%Y-%m-%d-%H-%M.bwlog 10800" bandwidth
CheckSpelling Off
Options FollowSymLinks IncludesNOEXEC ExecCGI
AllowOverride None
#AuthPAM_Enabled Off
Require all granted
Options FollowSymLinks IncludesNOEXEC ExecCGI
AllowOverride all
#AuthPAM_Enabled Off
RewriteEngine On
#RewriteLog /var/log/rewrite.log
#RewriteLogLevel 0
# RewriteLog is not available in Apache 2.4 it would be written to the standard error log
# by using
LogLevel info authz_core_module:info
# but the Apache documentation at
# https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html advises only to enable it if you need it
# Map to make domain name lowercase
RewriteMap lowercase int:tolower
# Map to translate URLs to filesystem paths
RewriteMap fspath "dbm=db:/data/config/web/fspath.db"
# Map to translate URLs to main web (cgi) username
RewriteMap uname "dbm=db:/data/config/web/uname.db"
# map for rails
RewriteMap rails "dbm=db:/data/config/web/rails.db"
# map for tomcat java servlets
RewriteMap jserv "dbm=db:/data/config/web/jserv.db"
# map for mobile
RewriteMap mobiurl "dbm=db:/data/config/web/mobile.db"
# map for mobile user-agents
RewriteMap mobiagent "dbm=db:/data/config/web/mobile-agent.db"
# Lowercase the domain name
RewriteCond ${lowercase:%{SERVER_NAME}} ^(.*)$
RewriteRule .* - [E=DOMAIN_NAME:%1,NS]
# Do not run vhost mapping against /server-status or already-expanded /data/ paths
RewriteCond %{REQUEST_URI} ^/server-status
RewriteRule .* - [END]
# Do not run the virtual-host mapping rules against already-expanded
# filesystem/data paths generated by DirectoryIndex subrequests.
RewriteCond %{REQUEST_URI} !\.php[3-5]?($|/)
RewriteRule ^/data/ - [END]
Include /data/config/web/blacklist.conf
# Now look for the domain name by itself
RewriteCond ${fspath:%{ENV:DOMAIN_NAME}} ^([^!]+)$
RewriteRule /(.*) /$1 [E=DOMAIN_PATH:%1,S=1]
# At this point, we are unable to lookup the entry in the fspath map, therefore
# the request is considered invalid. Redirect to a generic page.
RewriteCond %{REQUEST_URI} .*
RewriteCond %{REQUEST_URI} !^/~.*
RewriteRule .* /data/config/web/htdocs/invalid.html [L]
Include /data/config/web/maintenance.conf
# If this is a custom error message stop processing
# and just show the bloody thing already
RewriteCond %{REQUEST_URI} ^/data/templates/http-errors/.*
RewriteRule .* - [L]
# Extract the provisionkey and virtual path from the fspath value
RewriteCond %{ENV:DOMAIN_PATH} /([0-9]+)/user/([0-9]+)/ [OR]
RewriteCond %{ENV:DOMAIN_PATH} ^/data/templates/
RewriteRule .* - [E=PKEY:%1.%2,S=1]
# If we were not able to extract the provisionkey (meaning, the fspath is not
# in the form of \d+/user/\d+, then abort
RewriteCond %{REQUEST_URI} .*
RewriteRule .* - [F]
# domain name without www.
RewriteCond %{ENV:DOMAIN_NAME} ^(www\.)?(.+)$
RewriteRule .* - [E=DOMAIN_NAME_REAL:%2,NS]
# mobile environment variable
RewriteCond ${mobiurl:%{ENV:DOMAIN_NAME_REAL}} ^(http://)?(.+)$ [NC]
RewriteRule .* - [E=MOBILE_DOMAIN_NAME:%2,NS]
#additional conditions for hmaint-1399
# Check for redirect param
RewriteCond %{QUERY_STRING} ^.*redirect=true.*
RewriteRule ^(.*)$ - [co=mob_prevent_redirect:false:.%{ENV:DOMAIN_NAME_REAL}:0:/]
RewriteCond %{QUERY_STRING} ^.*redirect=false.*
RewriteRule ^(.*)$ - [co=mob_prevent_redirect:true:.%{ENV:DOMAIN_NAME_REAL}:1440:/]
# mobile env variable has contents
RewriteCond %{ENV:MOBILE_DOMAIN_NAME} .+
# mobile redirect not only for / uri-path
# hmaint 1399
#RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{HTTP_COOKIE} !mob_prevent_redirect=true [OR]
RewriteCond %{QUERY_STRING} ^.*redirect=true.*
# Don't redirect if its false
# mobile exclude url's with "noredirect" in QUERY_STRING
RewriteCond %{QUERY_STRING} !^.*noredirect.*$
RewriteCond %{QUERY_STRING} !^.*redirect=false.*$
# Exclude certain paths e.g. cpanel admin etc.
RewriteCond %{REQUEST_URI} !(.*)cpanel(/?)$
RewriteCond %{REQUEST_URI} !^/wp-(.*)$
RewriteCond %{REQUEST_URI} !/xmlrpc.php
# Exclude certain extensions e.g. images, docs etc
RewriteCond %{REQUEST_URI} !(.*)\.(?i:jpg|jpeg|webp|gif|bmp|png|js|css|txt|pdf|doc|docx|xls|xlsx|rar|zip|7z|mpg|mp4|mpeg|divx|avi|ogv|webm|mp3|ogg|wav|aac)$
# Switch based on significant accept headers
RewriteCond %{HTTP_ACCEPT} "text/vnd.wap.wml|application/vnd.wap.xhtml\+xml" [NC,OR]
# end hmaint 1399 addtiional conditions
# hmaint-1399 gomibi redirects
RewriteCond %{HTTP_USER_AGENT} "iphone|ipod|android|nokia|ios|opera m(ob|in)i|iemobile|symbian|samsung|sec-|htc|huawei|ericsson|sonyericsson|blackberry|motorola|sagem|kyocera|zte|kddi|docomo|j-phone|kwc|lenovo|lg|mot|softbank|nec|audiovox|alcatel|sharp|sie-|sanyo|sendo|amoi|xda|bird|benq|palm|pantech|panasonic|fly|asus-|baiduispider|googlebot-mobile|nintendo|psp|dalvik|windows ce|foma|brew|webos|fennec|netfront|teleca|obigo|vodafone|up.browser|portalmmm" [NC,OR]
RewriteCond ${mobiagent:%{HTTP_USER_AGENT}|false} mobile
# Don't redirect tablets (user agent contains a known tablet identifier)
RewriteCond %{HTTP_USER_AGENT} !.*(tablet|iPad).* [NC]
RewriteRule .? - [S=1]
RewriteRule .? - [S=3]
RewriteCond %{REQUEST_URI} ^(\/?)$
RewriteRule .? - [S=1]
RewriteRule ^(.*)$ http://%{ENV:MOBILE_DOMAIN_NAME}/w/%{ENV:DOMAIN_NAME}$1 [L,R=302]
RewriteRule ^(.*)$ http://%{ENV:MOBILE_DOMAIN_NAME}/ [L,R=302]
# Set up the expected rails uri for this user
RewriteCond ${rails:%{ENV:DOMAIN_NAME}|INVAL} ^(.+)$
RewriteRule .* - [E=RAILS_URI:%1]
# If they dont have a ruby app for this domain, skip proxy attempts
RewriteCond %{ENV:RAILS_URI} ^INVAL$
RewriteRule .* - [S=1]
# Neat hax, if their request_uri starts with the rails_uri env var, we match and proxy
RewriteCond %{ENV:RAILS_URI}#%{REQUEST_URI} ^(.*)#\1.*
RewriteRule .* http://10.30.84.22%{REQUEST_URI} [P]
# Tomcat Java Servlet redirect
# Look for a jserv entry and match on the IP:port found in the value
# If found, use that IP:port for the proxied request.
RewriteCond ${jserv:%{ENV:DOMAIN_NAME}} ^(\d+\.\d+\.\d+\.\d+:\d+).+$
RewriteRule .* http://%1%{REQUEST_URI} [P]
# Now that we know where the domain is hosted on the filesystem, we can start
# serving the files.
# first, deal with normal documents
RewriteCond %{REQUEST_URI} !^/icons/.*
RewriteCond %{REQUEST_URI} !^/awstats/icon/.*
RewriteCond %{REQUEST_URI} !^.*\.shtm(\?.*)?$
RewriteCond %{REQUEST_URI} !^.*\.php[3-5]?(\?+.*)?(/.*)?$
RewriteCond %{REQUEST_URI} !^.*/cgi-bin/.*
RewriteCond %{REQUEST_URI} !^/counter/.*
RewriteCond %{REQUEST_URI} !^/formmail/.*
RewriteCond %{REQUEST_URI} !^/fileman/.*
RewriteRule ^(.*)$ %{ENV:DOMAIN_PATH}$1 [L,UnsafePrefixStat]
# handle icons
RewriteCond %{REQUEST_URI} ^/icons/.*
RewriteRule ^(.*)$ /usr/services/vux/apache/$1 [L]
# handle awstats icons
RewriteCond %{REQUEST_URI} ^/awstats/icon/.*
RewriteRule ^(.*)$ /data/templates/$1 [L]
# We need to get the cgi user for the domain according to the PKEY.
RewriteCond ${uname:%{ENV:PKEY}} ^(.+)$
RewriteRule .* - [E=DOMAIN_USER:%1,S=1]
# Since we couldn't get the username mapping, there is no need to proceed
# Return an error
RewriteCond %{REQUEST_URI} .*
RewriteRule .* - [F]
# Filemananger has moved up here because the php rules below
# conflict with it. Otherwise, it errors out when attempting
# to work with php-suffixed files.
RewriteCond %{REQUEST_URI} ^/fileman/fileman.cgi.*
RewriteRule ^(.*) /~%{ENV:DOMAIN_USER}/cgi-bin/fileman.cgi [T=application/x-httpd-cgi,PT,L]
# Now deal with SSI
# Check if this domain name is allowed to run SSI
# If it is, then serve it and exit
RewriteCond %{REQUEST_URI} ^.*\.shtm(\?.*)?$
RewriteRule ^(.*)$ %{ENV:DOMAIN_PATH}/$1 [L]
# Execute PHP
RewriteCond %{ENV:DOMAIN_PATH} ^.*[0-9]+/user/[0-9]+/htdocs(/.*)?$
RewriteRule ^(.*\.(?:php|php3|php4|php5|phtml))(/.*)?$ /~%{ENV:DOMAIN_USER}/htdocs%1$1$2 [H=fcgid-script,PT,L]
# Now deal with CGIs
RewriteCond %{REQUEST_URI} ^.*/cgi-bin/.+
RewriteRule ^(.*)$ /~%{ENV:DOMAIN_USER}/$1 [H=cgi-script,PT]
# now, for the counter
RewriteCond %{REQUEST_URI} ^/counter/count.cgi.*
RewriteRule ^(.*) /~%{ENV:DOMAIN_USER}/$1 [H=cgi-script,PT,L]
# and.. the formmailer.
RewriteCond %{REQUEST_URI} ^/formmail/.*
RewriteRule ^(.*) /~%{ENV:DOMAIN_USER}/$1 [H=cgi-script,PT,L]
# The catch-all page will be displayed if none of the rules matched.
RewriteCond %{REQUEST_URI} .*
RewriteRule .* /data/config/web/htdocs/index.html [F,L]
UseCanonicalName Off
# Begin: HOSTINGDEV-2886
ProxyPreserveHost On
ProxyPass http://prod-iad-vux-fm-pod1501-lb.wnhosting.us-ashburn-1.ociprodhosting.registeredsite.com:8080/filemanager/
ProxyPassReverse http://prod-iad-vux-fm-pod1501-lb.wnhosting.us-ashburn-1.ociprodhosting.registeredsite.com:8080/filemanager/
RewriteEngine Off
# End: HOSTINGDEV-2886
RewriteEngine On
RewriteOptions Inherit