Apache 配置

概述

Apache HTTP Server 配置、虚拟主机、模块管理等技能。

基础管理

服务控制

CentOS/RHEL

systemctl start httpd systemctl stop httpd systemctl restart httpd systemctl reload httpd

Ubuntu/Debian

systemctl start apache2 systemctl stop apache2 systemctl restart apache2 systemctl reload apache2

配置测试

apachectl configtest httpd -t

配置文件

CentOS/RHEL

/etc/httpd/conf/httpd.conf /etc/httpd/conf.d/*.conf

Ubuntu/Debian

/etc/apache2/apache2.conf /etc/apache2/sites-available/ /etc/apache2/sites-enabled/

日志

/var/log/httpd/ # CentOS /var/log/apache2/ # Ubuntu

模块管理

Ubuntu/Debian

a2enmod rewrite # 启用模块 a2dismod rewrite # 禁用模块 a2ensite example.conf # 启用站点 a2dissite example.conf # 禁用站点

CentOS/RHEL

编辑 /etc/httpd/conf.modules.d/

httpd -M # 列出已加载模块

虚拟主机

基于域名

<VirtualHost *:80> ServerName example.com ServerAlias www.example.com DocumentRoot /var/www/example

<Directory /var/www/example>
    Options -Indexes +FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>

ErrorLog ${APACHE_LOG_DIR}/example-error.log
CustomLog ${APACHE_LOG_DIR}/example-access.log combined

</VirtualHost>

HTTPS 配置

<VirtualHost *:443> ServerName example.com DocumentRoot /var/www/example

SSLEngine on
SSLCertificateFile /etc/ssl/certs/example.crt
SSLCertificateKeyFile /etc/ssl/private/example.key
SSLCertificateChainFile /etc/ssl/certs/chain.crt

# SSL 优化
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
SSLHonorCipherOrder off

Header always set Strict-Transport-Security "max-age=31536000"

</VirtualHost>

HTTP 重定向

<VirtualHost *:80> ServerName example.com Redirect permanent / https://example.com/ </VirtualHost>

反向代理

基础代理

启用模块

a2enmod proxy proxy_http

<VirtualHost *:80> ServerName api.example.com

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:3000/
ProxyPassReverse / http://127.0.0.1:3000/

# 超时设置
ProxyTimeout 300

</VirtualHost>

负载均衡

启用模块

a2enmod proxy_balancer lbmethod_byrequests

<Proxy "balancer://mycluster"> BalancerMember http://192.168.1.10:8080 BalancerMember http://192.168.1.11:8080 ProxySet lbmethod=byrequests </Proxy>

<VirtualHost *:80> ServerName app.example.com ProxyPass / balancer://mycluster/ ProxyPassReverse / balancer://mycluster/ </VirtualHost>

URL 重写

基础重写

启用模块

a2enmod rewrite

<Directory /var/www/html> RewriteEngine On

# 强制 HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# 去除 www
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

# 前端路由（SPA）
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.html [L]

</Directory>

.htaccess

/var/www/html/.htaccess

RewriteEngine On

隐藏 .php 扩展名

RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME}.php -f RewriteRule ^(.*)$ $1.php [L]

防盗链

RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !^https?://(www.)?example.com [NC] RewriteRule .(jpg|jpeg|png|gif)$ - [F]

安全配置

基础安全

隐藏版本信息

ServerTokens Prod ServerSignature Off

禁用目录列表

<Directory /var/www> Options -Indexes </Directory>

安全头

Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "SAMEORIGIN" Header always set X-XSS-Protection "1; mode=block"

访问控制

IP 限制

<Directory /var/www/admin> Require ip 192.168.1.0/24 </Directory>

基础认证

<Directory /var/www/private> AuthType Basic AuthName "Restricted Area" AuthUserFile /etc/apache2/.htpasswd Require valid-user </Directory>

创建密码文件

htpasswd -c /etc/apache2/.htpasswd username

常见场景

场景 1：PHP 配置

<VirtualHost *:80> ServerName example.com DocumentRoot /var/www/html

<FilesMatch \.php$>
    SetHandler "proxy:unix:/var/run/php/php-fpm.sock|fcgi://localhost"
</FilesMatch>

<Directory /var/www/html>
    AllowOverride All
    Require all granted
</Directory>

</VirtualHost>

场景 2：限流

启用模块

a2enmod ratelimit

<Location /api> SetOutputFilter RATE_LIMIT SetEnv rate-limit 400 </Location>

场景 3：日志格式

LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i" %D" combined_time CustomLog ${APACHE_LOG_DIR}/access.log combined_time

故障排查

问题 排查方法

配置错误 apachectl configtest

403 Forbidden 检查目录权限、SELinux

500 Internal Error 查看 error.log

模块未加载 httpd -M 检查模块

性能问题 检查 MPM 配置、连接数