The recommendation its to use apache2 behind a reverse proxy setup, such like lighttpd or hiawatta servers. This version will only use Apache2 but we already has a better implementation using lighttpd, much more complete.
Due to the minimalism of alpine linux, unfortunately the apache2 packaging is the worst ever seen, its configuration file makes it impossible to configure with only single line commands so the commands for quick configuration with cares of overwriting are very dedicated. Currently the most lazy and slow server .. just for windosers that wants to learn..
apk add apache2 apache2-utils
mkdir -p /var/www/localhost/htdocs /var/log/apache2
sed -i -r 's#^Listen.*#Listen 80#g' /etc/apache2/httpd.conf
sed -i -r 's#^ServerTokens.*#ServerTokens Minimal#g' /etc/apache2/httpd.conf
chown -R apache:www-data /var/www/localhost/
chown -R apache:wheel /var/log/apache2
rc-update add apache2 default
rc-service apache2 restart
echo "it works" > /var/www/localhost/htdocs/index.html
For testing open a browser and go to http://<webserveripaddres> and you will see “it works”. The “webserveripaddres” are the ip address of your setup/server machine.
mkdir -p /var/www/localhost/htdocs/stats
sed -i -r 's#.*LoadModule.*modules/mod_info.so.*#LoadModule info_module modules/mod_info.so#g' /etc/apache2/httpd.conf
sed -i -r 's#.*LoadModule.*modules/mod_status.so.*#LoadModule status_module modules/mod_status.so#g' /etc/apache2/httpd.conf
sed -i -r 's#tion /server-status#tion /stats/server-status#g' /etc/apache2/conf.d/info.conf
sed -i -r 's#tion /server-info#tion /stats/server-info#g' /etc/apache2/conf.d/info.conf
sed -i -r 's#.*Require host.*#\# Require host#g' /etc/apache2/conf.d/info.conf
sed -i -r 's#.*Require ip.*#\# Require ip#g' /etc/apache2/conf.d/info.conf
rc-service apache2 restart
mkdir -p /var/www/localhost/cgi-bin
sed -i -r 's#.*LoadModule.*modules/mod_cgid.so.*#LoadModule cgid_module modules/mod_cgid.so#g' /etc/apache2/httpd.conf
sed -i -r 's#.*LoadModule.*modules/mod_cgi.so.*#LoadModule cgi_module modules/mod_cgi.so#g' /etc/apache2/httpd.conf
sed -i -r 's#.*LoadModule.*modules/mod_alias.so.*#LoadModule alias_module modules/mod_alias.so#g' /etc/apache2/httpd.conf
sed -i -r 's#.*ScriptAlias /cgi-bin/.*# ScriptAlias /cgi-bin/ "/var/www/localhost/cgi-bin"#g' /etc/apache2/httpd.conf
rc-service apache2 restart
After that, all the files under the /var/www/localhost/cgi-bin directory will be procesed under http://localhost/cgi-bin/ path to executed due the directives defined in the line 482 of the config file.
apk add apache2-error
rc-service apache2 restart
All about error documents are define at /etc/apache2/conf.d/multilang-errordoc.conf, you can customized byt redefine the error alias and the error codes. The right way is to make a symlink from /var/www/error-pages over each document and if there’s any customized remove the symlink and create the alternate error page there.
mkdir -p /etc/skel/public_html
for i in /home/*; do mkdir $i/public_html ; done
sed -i -r 's#.*LoadModule.*modules/mod_usertrack.so.*#LoadModule usertrack_module modules/mod_usertrack.so#g' /etc/apache2/httpd.conf
sed -i -r 's#.*LoadModule.*modules/mod_userdir.so.*#LoadModule userdir_module modules/mod_userdir.so#g' /etc/apache2/httpd.conf
sed -i -r 's#^UserDir .*#UserDir public_html#g' /etc/apache2/conf.d/userdir.conf
rc-service apache2 restart
Warning as we said.. alpine policy is to be most upstream equal possible, almost like packagers are lazy? NO! just dont put any thing about root user access, but well, you must know what are you doing, by the addition of
UserDir disabled root postmasteryou will denied specific users due security.
The error of the XML file in the proxy modules are due the incomplete right made package:
httpd: Syntax error on line 481 of /etc/apache2/httpd.conf: Syntax error on line 13 of /etc/apache2/conf.d/proxy-html.conf: Cannot load /usr/lib/libxml2.so into server: Error loading shared library /usr/lib/libxml2.so: No such file or directory
apk add apache2-proxy-html apache2-proxy
sed -i -r 's#/usr/lib/libxml2.so#/usr/lib/libxml2.so.2#g' /etc/apache2/conf.d/proxy-html.conf
cat >> /etc/apache2/conf.d/myproxy.conf << EOF
ProxyPreserveHost On
ProxyRequests off
AllowEncodedSlashes NoDecode
ProxyPass / http://127.0.0.1:3002/ nocanon
EOF
service apache2 restart
Warning of course, the
myproxy.confis hypothetical, for didactic purposes, here it is only exemplified that the error is corrected in the step of the sed command to work.
apk add openssl apache2-ssl
mkdir -p /etc/ssl/certs/
openssl req -x509 -days 1460 -nodes -newkey rsa:4096 \
-subj "/C=VE/ST=Bolivar/L=Upata/O=VenenuX/OU=Systemas:hozYmartillo/CN=$(hostname -d)" \
-keyout /etc/ssl/certs/localhost.pem -out /etc/ssl/certs/localhost.pem
chmod 640 /etc/ssl/certs/localhost.pem
chown apache:www-data /etc/ssl/certs/localhost.pem
sed -i -r 's#^SSLCertificateKeyFile.*/etc/#\#SSLCertificateKeyFile /etc/#g' /etc/apache2/conf.d/ssl.conf
sed -i -r 's#^SSLCertificateFile.*/etc/#SSLCertificateFile /etc/ssl/certs/localhost.pem#g' /etc/apache2/conf.d/ssl.conf
sed -i -r 's#^SSLCertificateChainFile.*#SSLCertificateChainFile /etc/ssl/certs/localhost.pem#g' /etc/apache2/conf.d/ssl.conf
sed -i -r 's#\#.*SSLCertificateChainFile.*#SSLCertificateChainFile /etc/ssl/certs/localhost.pem#g' /etc/apache2/conf.d/ssl.conf
sed -i -r 's#^Listen.*#Listen 443#g' /etc/apache2/conf.d/ssl.conf
sed -i -r 's#^<VirtualHost.*#<VirtualHost _default_:443>#g' /etc/apache2/conf.d/ssl.conf
sed -i -r 's#^SSLProtocol.*#SSLProtocol all#g' /etc/apache2/conf.d/ssl.conf
sed -i -r 's#^SSLCipherSuite.*#SSLCipherSuite HIGH:MEDIUM:ALL:!MD5:!RC4:!3DES#g' /etc/apache2/conf.d/ssl.conf
sed -i -r 's#^SSLProxyCipherSuite.*#SSLProxyCipherSuite HIGH:MEDIUM:ALL:!MD5:!RC4:!3DES#g' /etc/apache2/conf.d/ssl.conf
rc-service apache2 restart
Warning this configuration:
- This is a permissive configuration full compatible wtith older and newer browsers.
- to only allow most secure protocols and a bit of compatibilty, set to
SSLProtocol all -TLSv1 -SSLv3- to only allow most secure negociations and a bit of compat, set to
SSLCipherSuite HIGH:MEDIUM:ECDHE:!MD5:!RC4:!3DES:!ADH- to only allow most secure negociations and a bit of compat, set proxy to
SSLProxyCipherSuite HIGH:MEDIUM:ECDHE:!MD5:!RC4:!3DES:!ADH
The php packages in alpine are only one version at time.
Warning Those instructions are for php8 and alpine 3.16+ if you runs olders alpine from 3.8 until alpine 3.15 just change “8” to “7” in name packages for php7
apk add php8-opcache php8-openssl php8-json php8-bcmath php8-mbstring php8-bz2 php8-calendar \
php8-ctype php8-dev php8-dom php8-enchant php8-fileinfophp8-shmop php8-simplexml php8-tidy \
php8-tokenizer php8-sysvmsg php8-sysvsem php8-sysvshm php8-xml php8-xmlreader php8-xmlrpc \
php8-xmlwriter php8-xsl php8-zip
apk add php8-iconv php8-intl php8-gettext php8-pspell php8-recode
apk add php8-exif php8-gd php8-pcntl php8-gmp php8-litespeed
apk add php8-ftp php8-ldap php8-imap php8-session php8-snmp php8-sockets
apk add php8 php8-sockets php8-curl php8-pear php8-phar php8-doc php8-embed php8-posix
apk add php-fpm
apk add php fgi
apk add php8-dba php8-mysqli php8-mysqlnd php8-odbc php8-pgsql php8-sodium php8-sqlite3
apk add php8-pdo php8-pdo_dblib php8-pdo_mysql php8-pdo_odbc php8-pdo_pgsql php8-pdo_sqlite
apk add php8-apache2
Warning Those instructions are for php8 and alpine 3.16+ if you runs olders alpine from 3.8 until alpine 3.15 just change “8” to “7” in name packages for php7
sed -i -r 's|.*cgi.fix_pathinfo=.*|cgi.fix_pathinfo=1|g' /etc/php*/php.ini
sed -i -r 's#.*safe_mode =.*#safe_mode = Off#g' /etc/php*/php.ini
sed -i -r 's#.*expose_php =.*#expose_php = Off#g' /etc/php*/php.ini
sed -i -r 's#memory_limit =.*#memory_limit = 536M#g' /etc/php*/php.ini
sed -i -r 's#upload_max_filesize =.*#upload_max_filesize = 128M#g' /etc/php*/php.ini
sed -i -r 's#post_max_size =.*#post_max_size = 256M#g' /etc/php*/php.ini
sed -i -r 's#^file_uploads =.*#file_uploads = On#g' /etc/php*/php.ini
sed -i -r 's#^max_file_uploads =.*#max_file_uploads = 12#g' /etc/php*/php.ini
sed -i -r 's#^allow_url_fopen = .*#allow_url_fopen = On#g' /etc/php*/php.ini
sed -i -r 's#^.default_charset =.*#default_charset = "UTF-8"#g' /etc/php*/php.ini
sed -i -r 's#^.max_execution_time =.*#max_execution_time = 150#g' /etc/php*/php.ini
sed -i -r 's#^max_input_time =.*#max_input_time = 90#g' /etc/php*/php.ini
mkdir -p /var/run/php-fpm8/
chown apache:apache /var/run/php-fpm8
sed -i -r 's|^.*listen =.*|listen = /run/php-fpm8/php8-fpm.sock|g' /etc/php*/php-fpm.d/www.conf
sed -i -r 's|^pid =.*|pid = /run/php-fpm8/php8-fpm.pid|g' /etc/php*/php-fpm.conf
sed -i -r 's|^.*listen.owner = .*|listen.owner = apache|g' /etc/php*/php-fpm.d/www.conf
sed -i -r 's|^.*listen.group = .*|listen.group = apache|g' /etc/php*/php-fpm.d/www.conf
sed -i -r 's|^.*listen.mode = .*|listen.mode = 0660|g' /etc/php*/php-fpm.d/www.conf
sed -i -r 's|.*LoadModule.*modules/mod_mpm_event.so.*|LoadModule mpm_event_module modules/mod_mpm_event.so|g' /etc/apache2/httpd.conf
sed -i -r 's|.*LoadModule.*modules/mod_mpm_prefork.so.*|#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so|g' /etc/apache2/httpd.conf
rc-update add php-fpm8
rc-update add apache2
rc-service php-fpm8 start
cat >> /etc/apache2/conf.d/php8-module.conf << EOF
LoadModule php_module modules/mod_php8.so
DirectoryIndex index.php index.html
<FilesMatch \\.php\$>
SetHandler application/x-httpd-php
</FilesMatch>
EOF
rc-service apache2 start
cat >> /etc/apache2/conf.d/php-fpm.conf << EOF
<FilesMatch \\.php\$>
ProxyPassMatch "^/(.*\\.php(/.*)?)\$" "unix:/run/php-fpm8/php8-fpm.sock|fcgi://localhost/var/www/"
</FilesMatch>
EOF
rc-service apache2 start
WARNING the two last steps are mutualy exclusive, only one way of php handle can be made.
Note here we use sockets, so its more faster rather fcgi steps made by oficial wiki.
In alpine the only option is using Mariadb or Postgresql, ODBC only provides TDS and Postgresql, rest of options are only in edge or using other linuxes
The most secure for web Mysql managemend its adminer, cos phpmyadmin its too polite Adminer permits to manage any kind of database, including odbc, postgresql and mysql/mariadb.
mkdir -p /usr/share/webapps/adminer
wget https://github.com/vrana/adminer/releases/download/v4.8.1/adminer-4.8.1.php -O /usr/share/webapps/adminer/adminer-4.8.1.php
ln -s adminer-4.8.1.php /usr/share/webapps/adminer/index.php
cat >> /etc/apache2/conf.d/adminer.conf << EOF
Alias /adminer /usr/share/webapps/adminer/
<Directory /usr/share/webapps/adminer/>
Require all granted
DirectoryIndex index.php
</Directory>
rc-service apache2 restart
The administrator must use the exact URL
http://<ipaddress>/adminer/index.php There are two reasons: there's
no directory listing and there's no direct PHP index reference on the
web server, all because of paranoid settings.
apk add mysql mysql-client mariadb-doc mariadb-server-utils mariadb-mytop
mysql_install_db --user=mysql --datadir=/var/lib/mysql
rc-service mariadb start
mysqladmin -u root password toor
sed -i "s|.*max_allowed_packet\s*=.*|max_allowed_packet = 100M|g" /etc/mysql/my.cnf
sed -i "s|.*max_allowed_packet\s*=.*|max_allowed_packet = 100M|g" /etc/my.cnf.d/mariadb-server.cnf
sed -i "s|.*bind-address\s*=.*|bind-address=0.0.0.0|g" /etc/mysql/my.cnf
sed -i "s|.*bind-address\s*=.*|bind-address=0.0.0.0|g" /etc/my.cnf.d/mariadb-server.cnf
sed -i "s|.*skip-networking.*|#skip-networking|g" /etc/mysql/my.cnf
sed -i "s|.*skip-networking.*|#skip-networking|g" /etc/my.cnf.d/mariadb-server.cnf
rc-service mariadb restart
rc-update add mariadb
For information and more deep setup check ../documents/server-alpine-mysql-professional.md
Warning: the configuration here is for quick access and fist development, security is minimal only! for secure configuration set to specific bind-address or if you dont want remote access uncomment skip-networking
apk add postgresql postgresql-client postgresql-contrib postgresql-libs postgresql-orafce
rc-service postgresql setup
sed -r -i "s|.*listen_addresses.*=.*|listen_addresses=\*|g" /var/lib/postgresql/*/data/postgresql.conf*
rc-service postgresql start
rc-update add postgresql
psql -U postgres
create user postfix with password '******';
create database postfix owner postfix;
\c postfix
create language plpgsql;
\q
apk add unixodbc psqlodbc freetds mdbtools-odbc
cat > /tmp/tmppg.tmp << EOF
[PostgreSQL]
Description = PostgreSQL ODBC (ANSI version)
Driver = /usr/lib/psqlodbca.so
Debug = 0
CommLog = 1
[PostgreSQL-Unicode]
Description = PostgreSQL ODBC (Unicode version)
Driver = /usr/lib/psqlodbcw.so
Debug = 0
CommLog = 1
EOF
odbcinst -u -d -f /tmp/tmppg.tmp
cat > /tmp/tmptds.tmp << EOF
[FreeTDS]
Description = TDS module (Sybase/MS SQL)
Driver = /usr/lib/libtdsodbc.so.0
CPTimeout =
CPReuse =
odbcinst -u -d -f /tmp/tmptds.tmp
cat > /tmp/tmpmdb.tmp << EOF
[MDBTools]
Description = MDB modules for ODBC
Driver = /usr/lib/odbc/libmdbodbc.so
CPTimeout =
CPReuse =
odbcinst -u -d -f /tmp/tmpmdb.tmp
Warning the packages for mysql and sqlite are
sqliteodbcandmariadb-connector-odbcbut only available for edge.
Warning if your alpine version is too older, you cannot use the mysql edge package for odbc unfortunatelly
To obtain a real certificate, you must have a external direct public ip, so for local LAMP common deploys are nonsense.
Check the document guide-only-dehydrated.md there’s also a specific section to setup apache2.
##alpine_telegram_english#alpine_linux_englishCC BY-NC-SA: the project allows reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creators involved. If you remix, adapt, or build upon the material, you must license the modified material under identical terms, includes the following elements:
For more information check the alpine/copyright.md