damia apache config. situation as of 2021/03/16

2021-03-22 08:07:47 +01:00
commit 6d5210f1c0
70 changed files with 2873 additions and 0 deletions
--- a/damia/etc/apache2/mods-available/actions.conf
+++ b/damia/etc/apache2/mods-available/actions.conf
@@ -0,0 +1,11 @@
+# a2enmod-note: needs-configuration
+
+#
+# Action lets you define media types that will execute a script whenever
+# a matching file is called. This eliminates the need for repeated URL
+# pathnames for oft-used CGI file processors.
+# Format: Action media/type /cgi-script/location
+# Format: Action handler-name /cgi-script/location
+#
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/alias.conf
+++ b/damia/etc/apache2/mods-available/alias.conf
@@ -0,0 +1,24 @@
+<IfModule alias_module>
+	# Aliases: Add here as many aliases as you need (with no limit). The format is
+	# Alias fakename realname
+	#
+	# Note that if you include a trailing / on fakename then the server will
+	# require it to be present in the URL.  So "/icons" isn't aliased in this
+	# example, only "/icons/".  If the fakename is slash-terminated, then the
+	# realname must also be slash terminated, and if the fakename omits the
+	# trailing slash, the realname must also omit it.
+	#
+	# We include the /icons/ alias for FancyIndexed directory listings.  If
+	# you do not use FancyIndexing, you may comment this out.
+
+	Alias /icons/ "/usr/share/apache2/icons/"
+
+	<Directory "/usr/share/apache2/icons">
+		Options FollowSymlinks
+		AllowOverride None
+		Require all granted
+	</Directory>
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/autoindex.conf
+++ b/damia/etc/apache2/mods-available/autoindex.conf
@@ -0,0 +1,96 @@
+<IfModule mod_autoindex.c>
+	# Directives controlling the display of server-generated directory listings.
+
+	#
+	# IndexOptions: Controls the appearance of server-generated directory
+	# listings.
+	# Remove/replace the "Charset=UTF-8" if you don't use UTF-8 for your filenames.
+	IndexOptions FancyIndexing VersionSort HTMLTable NameWidth=* DescriptionWidth=* Charset=UTF-8
+
+	#
+	# AddIcon* directives tell the server which icon to show for different
+	# files or filename extensions.  These are only displayed for
+	# FancyIndexed directories.
+	AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip x-bzip2
+
+	AddIconByType (TXT,/icons/text.gif) text/*
+	AddIconByType (IMG,/icons/image2.gif) image/*
+	AddIconByType (SND,/icons/sound2.gif) audio/*
+	AddIconByType (VID,/icons/movie.gif) video/*
+
+	AddIcon /icons/binary.gif .bin .exe
+	AddIcon /icons/binhex.gif .hqx
+	AddIcon /icons/tar.gif .tar
+	AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
+	AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
+	AddIcon /icons/a.gif .ps .ai .eps
+	AddIcon /icons/layout.gif .html .shtml .htm .pdf
+	AddIcon /icons/text.gif .txt
+	AddIcon /icons/c.gif .c
+	AddIcon /icons/p.gif .pl .py
+	AddIcon /icons/f.gif .for
+	AddIcon /icons/dvi.gif .dvi
+	AddIcon /icons/uuencoded.gif .uu
+	AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+	AddIcon /icons/tex.gif .tex
+	# It's a suffix rule, so simply matching "core" matches "score" as well !
+	AddIcon /icons/bomb.gif /core
+	AddIcon (SND,/icons/sound2.gif) .ogg
+	AddIcon (VID,/icons/movie.gif) .ogm
+
+	AddIcon /icons/back.gif ..
+	AddIcon /icons/hand.right.gif README
+	AddIcon /icons/folder.gif ^^DIRECTORY^^
+	AddIcon /icons/blank.gif ^^BLANKICON^^
+
+	# Default icons for OpenDocument format
+	AddIcon /icons/odf6odt-20x22.png .odt
+	AddIcon /icons/odf6ods-20x22.png .ods
+	AddIcon /icons/odf6odp-20x22.png .odp
+	AddIcon /icons/odf6odg-20x22.png .odg
+	AddIcon /icons/odf6odc-20x22.png .odc
+	AddIcon /icons/odf6odf-20x22.png .odf
+	AddIcon /icons/odf6odb-20x22.png .odb
+	AddIcon /icons/odf6odi-20x22.png .odi
+	AddIcon /icons/odf6odm-20x22.png .odm
+
+	AddIcon /icons/odf6ott-20x22.png .ott
+	AddIcon /icons/odf6ots-20x22.png .ots
+	AddIcon /icons/odf6otp-20x22.png .otp
+	AddIcon /icons/odf6otg-20x22.png .otg
+	AddIcon /icons/odf6otc-20x22.png .otc
+	AddIcon /icons/odf6otf-20x22.png .otf
+	AddIcon /icons/odf6oti-20x22.png .oti
+	AddIcon /icons/odf6oth-20x22.png .oth
+
+	#
+	# DefaultIcon is which icon to show for files which do not have an icon
+	# explicitly set.
+	DefaultIcon /icons/unknown.gif
+
+	#
+	# AddDescription allows you to place a short description after a file in
+	# server-generated indexes.  These are only displayed for FancyIndexed
+	# directories.
+	# Format: AddDescription "description" filename
+	#AddDescription "GZIP compressed document" .gz
+	#AddDescription "tar archive" .tar
+	#AddDescription "GZIP compressed tar archive" .tgz
+
+	#
+	# ReadmeName is the name of the README file the server will look for by
+	# default, and append to directory listings.
+	#
+	# HeaderName is the name of a file which should be prepended to
+	# directory indexes
+	ReadmeName README.html
+	HeaderName HEADER.html
+
+	#
+	# IndexIgnore is a set of filenames which directory indexing should ignore
+	# and not include in the listing.  Shell-style wildcarding is permitted.
+	IndexIgnore .??* *~ *# RCS CVS *,v *,t
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/cache_disk.conf
+++ b/damia/etc/apache2/mods-available/cache_disk.conf
@@ -0,0 +1,27 @@
+<IfModule mod_cache_disk.c>
+
+	# cache cleaning is done by htcacheclean, which can be configured in
+	# /etc/default/apache2
+	#
+	# For further information, see the comments in that file,
+	# /usr/share/doc/apache2/README.Debian, and the htcacheclean(8)
+	# man page.
+
+	# This path must be the same as the one in /etc/default/apache2
+	CacheRoot /var/cache/apache2/mod_cache_disk
+
+	# This will also cache local documents. It usually makes more sense to
+	# put this into the configuration for just one virtual host.
+	#CacheEnable disk /
+
+
+    # The result of CacheDirLevels * CacheDirLength must not be higher than
+    # 20. Moreover, pay attention on file system limits. Some file systems
+    # do not support more than a certain number of inodes and
+    # subdirectories (e.g. 32000 for ext3)
+    CacheDirLevels 2
+    CacheDirLength 1
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/cgid.conf
+++ b/damia/etc/apache2/mods-available/cgid.conf
@@ -0,0 +1,4 @@
+# Socket for cgid communication
+ScriptSock ${APACHE_RUN_DIR}/cgisock
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/dav_fs.conf
+++ b/damia/etc/apache2/mods-available/dav_fs.conf
@@ -0,0 +1,3 @@
+DAVLockDB ${APACHE_LOCK_DIR}/DAVLock
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/deflate.conf
+++ b/damia/etc/apache2/mods-available/deflate.conf
@@ -0,0 +1,10 @@
+<IfModule mod_deflate.c>
+	<IfModule mod_filter.c>
+		AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
+		AddOutputFilterByType DEFLATE application/x-javascript application/javascript application/ecmascript
+		AddOutputFilterByType DEFLATE application/rss+xml
+		AddOutputFilterByType DEFLATE application/xml
+	</IfModule>
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/dir.conf
+++ b/damia/etc/apache2/mods-available/dir.conf
@@ -0,0 +1,5 @@
+<IfModule mod_dir.c>
+	DirectoryIndex index.html index.cgi index.pl index.php index.xhtml index.htm
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/http2.conf
+++ b/damia/etc/apache2/mods-available/http2.conf
@@ -0,0 +1,34 @@
+
+# mod_http2 doesn't work with mpm_prefork
+<IfModule !mpm_prefork>
+    Protocols h2 h2c http/1.1
+
+    # # HTTP/2 push configuration
+    # 
+    # H2Push          on
+    # 
+    # # Default Priority Rule
+    # 
+    # H2PushPriority * After 16
+    # 
+    # # More complex ruleset:
+    # 
+    # H2PushPriority  *                       after
+    # H2PushPriority  text/css                before
+    # H2PushPriority  image/jpeg              after   32
+    # H2PushPriority  image/png               after   32
+    # H2PushPriority  application/javascript  interleaved
+    # 
+    # # Configure some stylesheet and script to be pushed by the webserver
+    # 
+    # <FilesMatch "\.html$">
+    #     Header add Link "</style.css>; rel=preload; as=style"
+    #     Header add Link "</script.js>; rel=preload; as=script"
+    # </FilesMatch>
+    # Since mod_http2 doesn't support the mod_logio module (which provide the %O format),
+    # you may want to change your LogFormat directive as follow:
+    #
+    # LogFormat "%v:%p %h %l %u %t \"%r\" %>s %B \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+    # LogFormat "%h %l %u %t \"%r\" %>s %B \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    # LogFormat "%h %l %u %t \"%r\" %>s %B" common
+</IfModule>
--- a/damia/etc/apache2/mods-available/info.conf
+++ b/damia/etc/apache2/mods-available/info.conf
@@ -0,0 +1,15 @@
+<IfModule mod_info.c>
+
+	# Allow remote server configuration reports, with the URL of
+	#  http://servername/server-info (requires that mod_info.c be loaded).
+	# Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
+	#
+	<Location /server-info>
+		SetHandler server-info
+		Require local
+		#Require ip 192.0.2.0/24
+	</Location>
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/ldap.conf
+++ b/damia/etc/apache2/mods-available/ldap.conf
@@ -0,0 +1,6 @@
+<Location /ldap-status>
+	SetHandler ldap-status
+	Require local
+</Location>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/mime.conf
+++ b/damia/etc/apache2/mods-available/mime.conf
@@ -0,0 +1,251 @@
+<IfModule mod_mime.c>
+
+	#
+	# TypesConfig points to the file containing the list of mappings from
+	# filename extension to MIME-type.
+	#
+	TypesConfig /etc/mime.types
+
+	#
+	# AddType allows you to add to or override the MIME configuration
+	# file mime.types for specific file types.
+	#
+	#AddType application/x-gzip .tgz
+	#
+	# AddEncoding allows you to have certain browsers uncompress
+	# information on the fly. Note: Not all browsers support this.
+	# Despite the name similarity, the following Add* directives have
+	# nothing to do with the FancyIndexing customization directives above.
+	#
+	#AddEncoding x-compress .Z
+	#AddEncoding x-gzip .gz .tgz
+	#AddEncoding x-bzip2 .bz2
+	#
+	# If the AddEncoding directives above are commented-out, then you
+	# probably should define those extensions to indicate media types:
+	#
+	AddType application/x-compress .Z
+	AddType application/x-gzip .gz .tgz
+	AddType application/x-bzip2 .bz2
+
+	#
+	# DefaultLanguage and AddLanguage allows you to specify the language of 
+	# a document. You can then use content negotiation to give a browser a 
+	# file in a language the user can understand.
+	#
+	# Specify a default language. This means that all data
+	# going out without a specific language tag (see below) will 
+	# be marked with this one. You probably do NOT want to set
+	# this unless you are sure it is correct for all cases.
+	#
+	# * It is generally better to not mark a page as 
+	# * being a certain language than marking it with the wrong
+	# * language!
+	#
+	# DefaultLanguage nl
+	#
+	# Note 1: The suffix does not have to be the same as the language
+	# keyword --- those with documents in Polish (whose net-standard
+	# language code is pl) may wish to use "AddLanguage pl .po" to
+	# avoid the ambiguity with the common suffix for perl scripts.
+	#
+	# Note 2: The example entries below illustrate that in some cases 
+	# the two character 'Language' abbreviation is not identical to 
+	# the two character 'Country' code for its country,
+	# E.g. 'Danmark/dk' versus 'Danish/da'.
+	#
+	# Note 3: In the case of 'ltz' we violate the RFC by using a three char
+	# specifier. There is 'work in progress' to fix this and get
+	# the reference data for rfc1766 cleaned up.
+	#
+	# Catalan (ca) - Croatian (hr) - Czech (cs) - Danish (da) - Dutch (nl)
+	# English (en) - Esperanto (eo) - Estonian (et) - French (fr) - German (de)
+	# Greek-Modern (el) - Hebrew (he) - Italian (it) - Japanese (ja)
+	# Korean (ko) - Luxembourgeois* (ltz) - Norwegian Nynorsk (nn)
+	# Norwegian (no) - Polish (pl) - Portugese (pt)
+	# Brazilian Portuguese (pt-BR) - Russian (ru) - Swedish (sv)
+	# Simplified Chinese (zh-CN) - Spanish (es) - Traditional Chinese (zh-TW)
+	#
+	AddLanguage am .amh
+	AddLanguage ar .ara
+	AddLanguage be .be
+	AddLanguage bg .bg
+	AddLanguage bn .bn
+	AddLanguage br .br
+	AddLanguage bs .bs
+	AddLanguage ca .ca
+	AddLanguage cs .cz .cs
+	AddLanguage cy .cy
+	AddLanguage da .dk
+	AddLanguage de .de
+	AddLanguage dz .dz
+	AddLanguage el .el
+	AddLanguage en .en
+	AddLanguage eo .eo
+	# es is ecmascript in /etc/mime.types
+	RemoveType  es
+	AddLanguage es .es
+	AddLanguage et .et
+	AddLanguage eu .eu
+	AddLanguage fa .fa
+	AddLanguage fi .fi
+	AddLanguage fr .fr
+	AddLanguage ga .ga
+	AddLanguage gl .glg
+	AddLanguage gu .gu
+	AddLanguage he .he
+	AddLanguage hi .hi
+	AddLanguage hr .hr
+	AddLanguage hu .hu
+	AddLanguage hy .hy
+	AddLanguage id .id
+	AddLanguage is .is
+	AddLanguage it .it
+	AddLanguage ja .ja
+	AddLanguage ka .ka
+	AddLanguage kk .kk
+	AddLanguage km .km
+	AddLanguage kn .kn
+	AddLanguage ko .ko
+	AddLanguage ku .ku
+	AddLanguage lo .lo
+	AddLanguage lt .lt
+	AddLanguage ltz .ltz
+	AddLanguage lv .lv
+	AddLanguage mg .mg
+	AddLanguage mk .mk
+	AddLanguage ml .ml
+	AddLanguage mr .mr
+	AddLanguage ms .msa
+	AddLanguage nb .nob
+	AddLanguage ne .ne
+	AddLanguage nl .nl
+	AddLanguage nn .nn
+	AddLanguage no .no
+	AddLanguage pa .pa
+	AddLanguage pl .po
+	AddLanguage pt-BR .pt-br
+	AddLanguage pt .pt
+	AddLanguage ro .ro
+	AddLanguage ru .ru
+	AddLanguage sa .sa
+	AddLanguage se .se
+	AddLanguage si .si
+	AddLanguage sk .sk
+	AddLanguage sl .sl
+	AddLanguage sq .sq
+	AddLanguage sr .sr
+	AddLanguage sv .sv
+	AddLanguage ta .ta
+	AddLanguage te .te
+	AddLanguage th .th
+	AddLanguage tl .tl
+	RemoveType  tr
+	# tr is troff in /etc/mime.types
+	AddLanguage tr .tr
+	AddLanguage uk .uk
+	AddLanguage ur .ur
+	AddLanguage vi .vi
+	AddLanguage wo .wo
+	AddLanguage xh .xh
+	AddLanguage zh-CN .zh-cn
+	AddLanguage zh-TW .zh-tw
+
+	#
+	# Commonly used filename extensions to character sets. You probably
+	# want to avoid clashes with the language extensions, unless you
+	# are good at carefully testing your setup after each change.
+	# See http://www.iana.org/assignments/character-sets for the
+	# official list of charset names and their respective RFCs.
+	#
+	AddCharset us-ascii	.ascii .us-ascii
+	AddCharset ISO-8859-1  .iso8859-1  .latin1
+	AddCharset ISO-8859-2  .iso8859-2  .latin2 .cen
+	AddCharset ISO-8859-3  .iso8859-3  .latin3
+	AddCharset ISO-8859-4  .iso8859-4  .latin4
+	AddCharset ISO-8859-5  .iso8859-5  .cyr .iso-ru
+	AddCharset ISO-8859-6  .iso8859-6  .arb .arabic
+	AddCharset ISO-8859-7  .iso8859-7  .grk .greek
+	AddCharset ISO-8859-8  .iso8859-8  .heb .hebrew
+	AddCharset ISO-8859-9  .iso8859-9  .latin5 .trk
+	AddCharset ISO-8859-10  .iso8859-10  .latin6
+	AddCharset ISO-8859-13  .iso8859-13
+	AddCharset ISO-8859-14  .iso8859-14  .latin8
+	AddCharset ISO-8859-15  .iso8859-15  .latin9
+	AddCharset ISO-8859-16  .iso8859-16  .latin10
+	AddCharset ISO-2022-JP .iso2022-jp .jis
+	AddCharset ISO-2022-KR .iso2022-kr .kis
+	AddCharset ISO-2022-CN .iso2022-cn .cis
+	AddCharset Big5		.Big5	   .big5 .b5
+	AddCharset cn-Big5	 .cn-big5
+	# For russian, more than one charset is used (depends on client, mostly):
+	AddCharset WINDOWS-1251 .cp-1251   .win-1251
+	AddCharset CP866	   .cp866
+	AddCharset KOI8	  .koi8
+	AddCharset KOI8-E	  .koi8-e
+	AddCharset KOI8-r	  .koi8-r .koi8-ru
+	AddCharset KOI8-U	  .koi8-u
+	AddCharset KOI8-ru	 .koi8-uk .ua
+	AddCharset ISO-10646-UCS-2 .ucs2
+	AddCharset ISO-10646-UCS-4 .ucs4
+	AddCharset UTF-7	   .utf7
+	AddCharset UTF-8	   .utf8
+	AddCharset UTF-16	  .utf16
+	AddCharset UTF-16BE	.utf16be
+	AddCharset UTF-16LE	.utf16le
+	AddCharset UTF-32	  .utf32
+	AddCharset UTF-32BE	.utf32be
+	AddCharset UTF-32LE	.utf32le
+	AddCharset euc-cn	  .euc-cn
+	AddCharset euc-gb	  .euc-gb
+	AddCharset euc-jp	  .euc-jp
+	AddCharset euc-kr	  .euc-kr
+	#Not sure how euc-tw got in - IANA doesn't list it???
+	AddCharset EUC-TW	  .euc-tw
+	AddCharset gb2312	  .gb2312 .gb
+	AddCharset iso-10646-ucs-2 .ucs-2 .iso-10646-ucs-2
+	AddCharset iso-10646-ucs-4 .ucs-4 .iso-10646-ucs-4
+	AddCharset shift_jis   .shift_jis .sjis
+	AddCharset BRF		 .brf
+
+	#
+	# AddHandler allows you to map certain file extensions to "handlers":
+	# actions unrelated to filetype. These can be either built into the server
+	# or added with the Action directive (see below)
+	#
+	# To use CGI scripts outside of ScriptAliased directories:
+	# (You will also need to add "ExecCGI" to the "Options" directive.)
+	#
+	#AddHandler cgi-script .cgi
+
+	#
+	# For files that include their own HTTP headers:
+	#
+	#AddHandler send-as-is asis
+
+	#
+	# For server-parsed imagemap files:
+	#
+	#AddHandler imap-file map
+
+	#
+	# For type maps (negotiated resources):
+	# (This is enabled by default to allow the Apache "It Worked" page
+	#  to be distributed in multiple languages.)
+	#
+	AddHandler type-map var
+
+	#
+	# Filters allow you to process content before it is sent to the client.
+	#
+	# To parse .shtml files for server-side includes (SSI):
+	# (You will also need to add "Includes" to the "Options" directive.)
+	#
+	AddType text/html .shtml
+<IfModule mod_include.c>
+	AddOutputFilter INCLUDES .shtml
+</IfModule>
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/mime_magic.conf
+++ b/damia/etc/apache2/mods-available/mime_magic.conf
@@ -0,0 +1,5 @@
+<IfModule mod_mime_magic.c>
+	MIMEMagicFile /etc/apache2/magic
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/mpm_event.conf
+++ b/damia/etc/apache2/mods-available/mpm_event.conf
@@ -0,0 +1,18 @@
+# event MPM
+# StartServers: initial number of server processes to start
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxRequestWorkers: maximum number of worker threads
+# MaxConnectionsPerChild: maximum number of requests a server process serves
+<IfModule mpm_event_module>
+	StartServers			 2
+	MinSpareThreads		 25
+	MaxSpareThreads		 75
+	ThreadLimit			 64
+	ThreadsPerChild		 25
+	MaxRequestWorkers	  150
+	MaxConnectionsPerChild   0
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/mpm_prefork.conf
+++ b/damia/etc/apache2/mods-available/mpm_prefork.conf
@@ -0,0 +1,16 @@
+# prefork MPM
+# StartServers: number of server processes to start
+# MinSpareServers: minimum number of server processes which are kept spare
+# MaxSpareServers: maximum number of server processes which are kept spare
+# MaxRequestWorkers: maximum number of server processes allowed to start
+# MaxConnectionsPerChild: maximum number of requests a server process serves
+
+<IfModule mpm_prefork_module>
+	StartServers			 5
+	MinSpareServers		  5
+	MaxSpareServers		 10
+	MaxRequestWorkers	  150
+	MaxConnectionsPerChild   0
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/mpm_worker.conf
+++ b/damia/etc/apache2/mods-available/mpm_worker.conf
@@ -0,0 +1,22 @@
+# worker MPM
+# StartServers: initial number of server processes to start
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a
+#			  graceful restart. ThreadLimit can only be changed by stopping
+#			  and starting Apache.
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxRequestWorkers: maximum number of threads
+# MaxConnectionsPerChild: maximum number of requests a server process serves
+
+<IfModule mpm_worker_module>
+	StartServers			 2
+	MinSpareThreads		 25
+	MaxSpareThreads		 75
+	ThreadLimit			 64
+	ThreadsPerChild		 25
+	MaxRequestWorkers	  150
+	MaxConnectionsPerChild   0
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/negotiation.conf
+++ b/damia/etc/apache2/mods-available/negotiation.conf
@@ -0,0 +1,20 @@
+<IfModule mod_negotiation.c>
+
+	# LanguagePriority allows you to give precedence to some languages
+	# in case of a tie during content negotiation.
+	#
+	# Just list the languages in decreasing order of preference. We have
+	# more or less alphabetized them here. You probably want to change this.
+	#
+	LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv tr zh-CN zh-TW
+
+	#
+	# ForceLanguagePriority allows you to serve a result page rather than
+	# MULTIPLE CHOICES (Prefer) [in case of a tie] or NOT ACCEPTABLE (Fallback)
+	# [in case no accepted languages matched the available variants]
+	#
+	ForceLanguagePriority Prefer Fallback
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/php5.conf
+++ b/damia/etc/apache2/mods-available/php5.conf
@@ -0,0 +1,25 @@
+<FilesMatch ".+\.ph(p[345]?|t|tml)$">
+    SetHandler application/x-httpd-php
+</FilesMatch>
+<FilesMatch ".+\.phps$">
+    SetHandler application/x-httpd-php-source
+    # Deny access to raw php sources by default
+    # To re-enable it's recommended to enable access to the files
+    # only in specific virtual host or directory
+    Require all denied
+</FilesMatch>
+# Deny access to files without filename (e.g. '.php')
+<FilesMatch "^\.ph(p[345]?|t|tml|ps)$">
+    Require all denied
+</FilesMatch>
+
+# Running PHP scripts in user directories is disabled by default
+# 
+# To re-enable PHP in user directories comment the following lines
+# (from <IfModule ...> to </IfModule>.) Do NOT set it to On as it
+# prevents .htaccess files from disabling it.
+<IfModule mod_userdir.c>
+    <Directory /home/*/public_html>
+        php_admin_flag engine Off
+    </Directory>
+</IfModule>
--- a/damia/etc/apache2/mods-available/php7.4.conf
+++ b/damia/etc/apache2/mods-available/php7.4.conf
@@ -0,0 +1,25 @@
+<FilesMatch ".+\.ph(ar|p|tml)$">
+    SetHandler application/x-httpd-php
+</FilesMatch>
+<FilesMatch ".+\.phps$">
+    SetHandler application/x-httpd-php-source
+    # Deny access to raw php sources by default
+    # To re-enable it's recommended to enable access to the files
+    # only in specific virtual host or directory
+    Require all denied
+</FilesMatch>
+# Deny access to files without filename (e.g. '.php')
+<FilesMatch "^\.ph(ar|p|ps|tml)$">
+    Require all denied
+</FilesMatch>
+
+# Running PHP scripts in user directories is disabled by default
+# 
+# To re-enable PHP in user directories comment the following lines
+# (from <IfModule ...> to </IfModule>.) Do NOT set it to On as it
+# prevents .htaccess files from disabling it.
+<IfModule mod_userdir.c>
+    <Directory /home/*/public_html>
+        php_admin_flag engine Off
+    </Directory>
+</IfModule>
--- a/damia/etc/apache2/mods-available/proxy.conf
+++ b/damia/etc/apache2/mods-available/proxy.conf
@@ -0,0 +1,27 @@
+<IfModule mod_proxy.c>
+
+	# If you want to use apache2 as a forward proxy, uncomment the
+	# 'ProxyRequests On' line and the <Proxy *> block below.
+	# WARNING: Be careful to restrict access inside the <Proxy *> block.
+	# Open proxy servers are dangerous both to your network and to the
+	# Internet at large.
+	#
+	# If you only want to use apache2 as a reverse proxy/gateway in
+	# front of some web application server, you DON'T need
+	# 'ProxyRequests On'.
+
+	#ProxyRequests On
+	#<Proxy *>
+	#   AddDefaultCharset off
+	#   Require all denied
+	#   #Require local
+	#</Proxy>
+
+	# Enable/disable the handling of HTTP/1.1 "Via:" headers.
+	# ("Full" adds the server version; "Block" removes all outgoing Via: headers)
+	# Set to one of: Off | On | Full | Block
+	#ProxyVia Off
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/proxy_balancer.conf
+++ b/damia/etc/apache2/mods-available/proxy_balancer.conf
@@ -0,0 +1,15 @@
+<IfModule mod_proxy_balancer.c>
+
+	# Balancer manager enables dynamic update of balancer members
+	# (needs mod_status). Uncomment to enable.
+	#
+	#<IfModule mod_status.c>
+	#   <Location /balancer-manager>
+	#	   SetHandler balancer-manager
+	#	   Require local
+	#   </Location>
+	#</IfModule>
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/proxy_ftp.conf
+++ b/damia/etc/apache2/mods-available/proxy_ftp.conf
@@ -0,0 +1,8 @@
+<IfModule mod_proxy_ftp.c>
+
+	# Define the character set for proxied FTP listings. Default is ISO-8859-1
+	ProxyFtpDirCharset UTF-8
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/proxy_html.conf
+++ b/damia/etc/apache2/mods-available/proxy_html.conf
@@ -0,0 +1,75 @@
+# Configuration example.
+#
+# For detailed information about these directives see
+# <URL:http://httpd.apache.org/docs/2.4/mod/mod_proxy_html.html>
+# and for mod_xml2enc see
+# <URL:http://httpd.apache.org/docs/2.4/mod/mod_xml2enc.html>
+#
+
+# All knowledge of HTML links has been removed from the mod_proxy_html
+# code itself, and is instead read from httpd.conf (or included file)
+# at server startup.  So you MUST declare it.  This will normally be
+# at top level, but can also be used in a <Location>.
+#
+# Here's the declaration for W3C HTML 4.01 and XHTML 1.0
+
+ProxyHTMLLinks	a		href
+ProxyHTMLLinks	area		href
+ProxyHTMLLinks	link		href
+ProxyHTMLLinks	img		src longdesc usemap
+ProxyHTMLLinks	object		classid codebase data usemap
+ProxyHTMLLinks	q		cite
+ProxyHTMLLinks	blockquote	cite
+ProxyHTMLLinks	ins		cite
+ProxyHTMLLinks	del		cite
+ProxyHTMLLinks	form		action
+ProxyHTMLLinks	input		src usemap
+ProxyHTMLLinks	head		profile
+ProxyHTMLLinks	base		href
+ProxyHTMLLinks	script		src for
+
+# To support scripting events (with ProxyHTMLExtended On),
+# you'll need to declare them too.
+
+ProxyHTMLEvents	onclick ondblclick onmousedown onmouseup \
+		onmouseover onmousemove onmouseout onkeypress \
+		onkeydown onkeyup onfocus onblur onload \
+		onunload onsubmit onreset onselect onchange
+
+# If you need to support legacy (pre-1998, aka "transitional") HTML or XHTML,
+# you'll need to uncomment the following deprecated link attributes.
+# Note that these are enabled in earlier mod_proxy_html versions
+#
+# ProxyHTMLLinks	frame		src longdesc
+# ProxyHTMLLinks	iframe		src longdesc
+# ProxyHTMLLinks	body		background
+# ProxyHTMLLinks	applet		codebase
+#
+# If you're dealing with proprietary HTML variants,
+# declare your own URL attributes here as required.
+#
+# ProxyHTMLLinks	myelement	myattr otherattr
+#
+###########
+# EXAMPLE #
+###########
+#
+# To define the URL /my-gateway/ as a gateway to an appserver with address
+# http://some.app.intranet/ on a private network, after loading the
+# modules and including this configuration file:
+#
+# ProxyRequests Off  <-- this is an important security setting
+# ProxyPass /my-gateway/ http://some.app.intranet/
+# <Location /my-gateway/>
+#	ProxyPassReverse /
+#	ProxyHTMLEnable On
+#	ProxyHTMLURLMap http://some.app.intranet/ /my-gateway/
+#	ProxyHTMLURLMap / /my-gateway/
+# </Location>
+#
+# Many (though not all) real-life setups are more complex.
+#
+# See the documentation at
+# http://apache.webthing.com/mod_proxy_html/
+# and the tutorial at
+# http://www.apachetutor.org/admin/reverseproxies
--- a/damia/etc/apache2/mods-available/reqtimeout.conf
+++ b/damia/etc/apache2/mods-available/reqtimeout.conf
@@ -0,0 +1,27 @@
+<IfModule reqtimeout_module>
+
+	# mod_reqtimeout limits the time waiting on the client to prevent an
+	# attacker from causing a denial of service by opening many connections
+	# but not sending requests. This file tries to give a sensible default
+	# configuration, but it may be necessary to tune the timeout values to
+	# the actual situation. Note that it is also possible to configure
+	# mod_reqtimeout per virtual host.
+
+
+	# Wait max 20 seconds for the first byte of the request line+headers
+	# From then, require a minimum data rate of 500 bytes/s, but don't
+	# wait longer than 40 seconds in total.
+	# Note: Lower timeouts may make sense on non-ssl virtual hosts but can
+	# cause problem with ssl enabled virtual hosts: This timeout includes
+	# the time a browser may need to fetch the CRL for the certificate. If
+	# the CRL server is not reachable, it may take more than 10 seconds
+	# until the browser gives up.
+	RequestReadTimeout header=20-40,minrate=500
+
+	# Wait max 10 seconds for the first byte of the request body (if any)
+	# From then, require a minimum data rate of 500 bytes/s
+	RequestReadTimeout body=10,minrate=500
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/setenvif.conf
+++ b/damia/etc/apache2/mods-available/setenvif.conf
@@ -0,0 +1,32 @@
+<IfModule mod_setenvif.c>
+
+	#
+	# The following directives modify normal HTTP response behavior to
+	# handle known problems with browser implementations.
+	#
+	BrowserMatch "Mozilla/2" nokeepalive
+	BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
+	BrowserMatch "RealPlayer 4\.0" force-response-1.0
+	BrowserMatch "Java/1\.0" force-response-1.0
+	BrowserMatch "JDK/1\.0" force-response-1.0
+
+	#
+	# The following directive disables redirects on non-GET requests for
+	# a directory that does not include the trailing slash.  This fixes a
+	# problem with Microsoft WebFolders which does not appropriately handle
+	# redirects for folders with DAV methods.
+	# Same deal with Apple's DAV filesystem and Gnome VFS support for DAV.
+	#
+	BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
+	BrowserMatch "MS FrontPage" redirect-carefully
+	BrowserMatch "^WebDrive" redirect-carefully
+	BrowserMatch "^WebDAVFS/1.[012]" redirect-carefully
+	BrowserMatch "^gnome-vfs/1.0" redirect-carefully
+	BrowserMatch "^gvfs/1" redirect-carefully
+	BrowserMatch "^XML Spy" redirect-carefully
+	BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
+	BrowserMatch " Konqueror/4" redirect-carefully
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/ssl.conf
+++ b/damia/etc/apache2/mods-available/ssl.conf
@@ -0,0 +1,85 @@
+<IfModule mod_ssl.c>
+
+	# Pseudo Random Number Generator (PRNG):
+	# Configure one or more sources to seed the PRNG of the SSL library.
+	# The seed data should be of good random quality.
+	# WARNING! On some platforms /dev/random blocks if not enough entropy
+	# is available. This means you then cannot use the /dev/random device
+	# because it would lead to very long connection times (as long as
+	# it requires to make more entropy available). But usually those
+	# platforms additionally provide a /dev/urandom device which doesn't
+	# block. So, if available, use this one instead. Read the mod_ssl User
+	# Manual for more details.
+	#
+	SSLRandomSeed startup builtin
+	SSLRandomSeed startup file:/dev/urandom 512
+	SSLRandomSeed connect builtin
+	SSLRandomSeed connect file:/dev/urandom 512
+
+	##
+	##  SSL Global Context
+	##
+	##  All SSL configuration in this context applies both to
+	##  the main server and all SSL-enabled virtual hosts.
+	##
+
+	#
+	#   Some MIME-types for downloading Certificates and CRLs
+	#
+	AddType application/x-x509-ca-cert .crt
+	AddType application/x-pkcs7-crl	.crl
+
+	#   Pass Phrase Dialog:
+	#   Configure the pass phrase gathering process.
+	#   The filtering dialog program (`builtin' is a internal
+	#   terminal dialog) has to provide the pass phrase on stdout.
+	SSLPassPhraseDialog  exec:/usr/share/apache2/ask-for-passphrase
+
+	#   Inter-Process Session Cache:
+	#   Configure the SSL Session Cache: First the mechanism 
+	#   to use and second the expiring timeout (in seconds).
+	#   (The mechanism dbm has known memory leaks and should not be used).
+	#SSLSessionCache		 dbm:${APACHE_RUN_DIR}/ssl_scache
+	SSLSessionCache		shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
+	SSLSessionCacheTimeout  300
+
+	#   Semaphore:
+	#   Configure the path to the mutual exclusion semaphore the
+	#   SSL engine uses internally for inter-process synchronization. 
+	#   (Disabled by default, the global Mutex directive consolidates by default
+	#   this)
+	#Mutex file:${APACHE_LOCK_DIR}/ssl_mutex ssl-cache
+
+
+	#   SSL Cipher Suite:
+	#   List the ciphers that the client is permitted to negotiate. See the
+	#   ciphers(1) man page from the openssl package for list of all available
+	#   options.
+	#   Enable only secure ciphers:
+	SSLCipherSuite HIGH:!aNULL
+
+	# SSL server cipher order preference:
+	# Use server priorities for cipher algorithm choice.
+	# Clients may prefer lower grade encryption.  You should enable this
+	# option if you want to enforce stronger encryption, and can afford
+	# the CPU cost, and did not override SSLCipherSuite in a way that puts
+	# insecure ciphers first.
+	# Default: Off
+	#SSLHonorCipherOrder on
+
+	#   The protocols to enable.
+	#   Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+	#   SSL v2  is no longer supported
+	SSLProtocol all -SSLv3
+
+	#   Allow insecure renegotiation with clients which do not yet support the
+	#   secure renegotiation protocol. Default: Off
+	#SSLInsecureRenegotiation on
+
+	#   Whether to forbid non-SNI clients to access name based virtual hosts.
+	#   Default: Off
+	#SSLStrictSNIVHostCheck On
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/status.conf
+++ b/damia/etc/apache2/mods-available/status.conf
@@ -0,0 +1,29 @@
+<IfModule mod_status.c>
+	# Allow server status reports generated by mod_status,
+	# with the URL of http://servername/server-status
+	# Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
+
+	<Location /server-status>
+		SetHandler server-status
+		Require local
+		#Require ip 192.0.2.0/24
+	</Location>
+
+	# Keep track of extended status information for each request
+	ExtendedStatus On
+
+	# Determine if mod_status displays the first 63 characters of a request or
+	# the last 63, assuming the request itself is greater than 63 chars.
+	# Default: Off
+	#SeeRequestTail On
+
+
+	<IfModule mod_proxy.c>
+		# Show Proxy LoadBalancer status in mod_status
+		ProxyStatus On
+	</IfModule>
+
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
--- a/damia/etc/apache2/mods-available/userdir.conf
+++ b/damia/etc/apache2/mods-available/userdir.conf
@@ -0,0 +1,12 @@
+<IfModule mod_userdir.c>
+	UserDir public_html
+	UserDir disabled root
+
+	<Directory /home/*/public_html>
+		AllowOverride FileInfo AuthConfig Limit Indexes
+		Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+		Require method GET POST OPTIONS
+	</Directory>
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet