Build Production-Ready Apache Configurations

This skill provides expertise in Apache HTTP Server configuration, with deep knowledge of httpd.conf, virtual hosts, modules, security hardening, performance optimization, and deployment patterns across Apache 2.4+, mod_rewrite, and SSL/TLS. Core configuration principles cover core directive structure (ServerRoot and server identification first, Listen directives before virtual hosts, explicit module loading, Directory/Location blocks for granular control, and proper logging) and a security-first approach (disabling unneeded modules and features, hiding server/version information, proper access control, default security headers, and modern SSL/TLS cipher configuration).

Base server configuration sets process/connection tuning (StartServers, MinSpareServers, MaxRequestWorkers, ThreadsPerChild), a security baseline (ServerTokens Prod, ServerSignature Off, TraceEnable Off), essential modules (rewrite, ssl, headers, deflate), and default security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, X-XSS-Protection). Virtual host patterns include a production HTTPS vhost with modern SSL protocol/cipher restrictions, HSTS, combined access/error logging, and compression, alongside an HTTP-to-HTTPS redirect vhost. Advanced security configuration covers directory access control (disabling indexes/CGI/symlinks, denying access to sensitive file extensions like .htaccess/.sql/.conf), hiding .git directories, and rate limiting via mod_evasive.

Performance optimization covers browser caching (mod_expires rules per content type), ETag configuration, and compression (mod_deflate for text/JS/XML content types). URL rewriting and routing covers common mod_rewrite patterns - forcing HTTPS, removing the www prefix, pretty URLs for PHP-based routing, and API endpoint routing. Monitoring and logging covers a custom LogFormat including request duration, per-vhost separate log files, and server-status/server-info locations restricted to trusted IPs for monitoring. Best practices cover configuration management (separate files per concern like ssl.conf/security.conf, apache2ctl configtest before reload, backups, version control, and documentation), performance tuning (monitoring MaxRequestWorkers against available memory, choosing the right MPM - prefork/worker/event - compression, caching, and log rotation), and security hardening (regular updates, fail2ban or similar intrusion prevention, WAF rules, security audits/pen testing, and access log monitoring for suspicious activity). Configurations should always be validated in development before production deployment, with separate config sets per environment.

Use this skill when configuring or hardening an Apache HTTP Server deployment - virtual hosts, SSL/TLS, security headers, caching, or URL rewriting. It is well suited to production Apache deployments needing modern security and performance settings. It is not meant for other web servers (Nginx, Caddy), or for a trivial local dev server with no security/performance requirements.

Input: the site/application being served, its domain(s), and security/performance requirements.

Output: complete Apache configuration files - virtual hosts, security headers, SSL/TLS settings, caching, and rewrite rules. Example production HTTPS vhost security settings:

SSLEngine on
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

Configures Apache HTTP Server directly, including mod_ssl, mod_headers, mod_deflate, mod_rewrite, and mod_evasive modules, validated with apache2ctl configtest.

Systems and DevOps engineers configuring or hardening production Apache deployments, and teams that need modern SSL/TLS, security headers, and caching configured correctly from the start.