Simplifying Apache Multiple Port Config

[LosOjos]

Wondering if anyone has any thoughts on this.

 

I've been setting up my website and subdomains to make use of my Let's Encrypt certificate - all working fine, no problems there (and I'm keeping standard HTTP alive while LE is in beta)

 

One thing that's bugging me though is I fell the Apache config to do this is overly complicated. The vast majority of the config for my sites is identical, regardless of whether the client came in on 80 or 443, so I feel there ought to be a simpler way of representing this in Apache.

 

I've simplified it massively by using 'Include' so that now I have something like this:

 

ServerName example.com
Include /var/www/example.com.conf



ServerName example.com
Include /var/www/example.conf
Include /var/www/ssl.conf



ServerName test.com
Include /var/www/test.com.conf



ServerName test.com
Include /var/www/test.com.conf
Include /var/www/ssl.conf

 

However, the coder in me feels like there must be some 'If' statement I'm missing that would make this even simpler. I'm think something along the lines of:

 

ServerName example.com
Include /var/www/example.com.conf

	Include /var/www/ssl.conf




ServerName test.com
Include /var/www/test.com.conf

	Include /var/www/ssl.conf

 

Is something along those lines possible, or have I already simplified things as much as I'm going to?

Edited November 18, 2015 by LosOjos

[Geoff]

You're not far off. If you do the following in your main config file:

 

IncludeOptional sites/*.conf

 

Then anything in the sites sub folder that matches will be included, thus you can have sites/www.example.conf and sites/www.somethingelse.conf and keep per site configuration separate.

 

Furthermore to untangle your SSL 'if' section you can do the following:

 

 Include ssl.conf

 

If you are using a Linux distribution based on Debian, all this setup is included in the default config for the apache2 package for you already.

[LosOjos]

You're not far off. If you do the following in your main config file:

 

IncludeOptional sites/*.conf

 

Then anything in the sites sub folder that matches will be included, thus you can have sites/www.example.conf and sites/www.somethingelse.conf and keep per site configuration separate.

 

Furthermore to untangle your SSL 'if' section you can do the following:

 

 Include ssl.conf

 

If you are using a Linux distribution based on Debian, all this setup is included in the default config for the apache2 package for you already.

 

Thanks @Geoff, however I'm not sure the IfModule directive works for this, it seems to always trigger if mod_ssl is enabled, not necessarily when the site has been accessed via HTTPS, causing client errors when trying to access the site via HTTP (complaint about trying to access an HTTPS site over an insecure port (80))

 

Will certainly make use of the IncludeOptional though, will help clean things up.

[Geoff]

That's because you are doing things the wrong way round. You need to define two sites, one for SSL and one for normal HTTP access. Then enclose the ssl site definition within the ifmodule check. If the SSL module isn't loaded, it's not going to work anyway.

 

	ServerName example.com





ServerName example.com

Include /var/www/ssl.conf

[LosOjos]

That's because you are doing things the wrong way round. You need to define two sites, one for SSL and one for normal HTTP access. Then enclose the ssl site definition within the ifmodule check. If the SSL module isn't loaded, it's not going to work anyway.

 

	ServerName example.com





ServerName example.com

Include /var/www/ssl.conf

 

That's what I'm doing at the moment, I was just looking for a way to 'catch all' in one VirtualHost block and then only apply SSL config if the client had come in on 443...

 

It seems it should be possible in Apache 2.3 with , but I'm on 2.2 at the moment and want to set aside a few hours for the upgrade, just in case it all breaks!

 

Like I said, it's working fine as it is, I was just looking for any ways to trim down the repetition further.

[Geoff]

You can't do that anyway. As you are required to bind an SSL site to a specific IP address (otherwise Apache doesn't know which certificates to use). The only exception is if you are using a wildcard cert and all your SSL sites run under the same domain (and thus the wildcard cert works for all of them).

 

https://wiki.apache.org/httpd/NameBasedSSLVHosts

 

Although there is an extension called SNI that solves the issue. However this limits what browsers you can support somewhat.

 

https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

Edited November 18, 2015 by Geoff