Host two domains on one server
Create two name-based VirtualHost blocks: one for site-a.example and one for site-b.example. Each should serve a different DocumentRoot and write separate access logs.
Backend & Runtime / Knowledge library
Apache HTTP Server (apachehttpd)
open-source web server for http and https delivery
Why learn Apache HTTP Server (apachehttpd)?
Apache HTTP Server delivers websites and APIs over HTTP/HTTPS with flexible routing, virtual hosting, access control, logging, and module-based extensibility. It helps backend teams host multiple apps, terminate TLS, and reverse-proxy traffic from one configurable edge server.
Where it came from
1995: Began as a community patch set around NCSA HTTPd (often described as 'a patchy server'). 1999: Apache Software Foundation (ASF) was formed to steward projects including httpd. 2002: Apache 2.0 introduced major architectural changes, including MPM support. 2012: Apache 2.4 became the long-term mainstream branch with improved performance and authz model. Today: Apache remains a core web infrastructure component for hosting, proxying, and legacy modernization.
- 1995: Began as a community patch set around NCSA HTTPd (often described as 'a patchy server').
- 1999: Apache Software Foundation (ASF) was formed to steward projects including httpd.
- 2002: Apache 2.0 introduced major architectural changes, including MPM support.
- 2012: Apache 2.4 became the long-term mainstream branch with improved performance and authz model.
- Today: Apache remains a core web infrastructure component for hosting, proxying, and legacy modernization.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Create two name-based VirtualHost blocks: one for site-a.example and one for site-b.example. Each should serve a different DocumentRoot and write separate access logs.
- Configure Apache to terminate TLS on :443 and proxy requests to a local app on port 3000. Preserve the original Host header and redirect all :80 traffic to HTTPS.
- Protect /admin with authentication and allow only a specific CIDR range. Return 403 for unauthorized users and verify rule order with test cases.
- Compare prefork, worker, and event MPM for a mixed static + proxied workload. Choose one, justify it, and propose baseline settings for KeepAlive and MaxRequestWorkers.
- Design a safe rollout flow: config lint, syntax test, canary VirtualHost, graceful reload, rollback trigger, and post-deploy log checks.
More ways to practice
Reverse proxy a backend app
Configure Apache to terminate TLS on :443 and proxy requests to a local app on port 3000. Preserve the original Host header and redirect all :80 traffic to HTTPS.
Harden an admin route
Protect /admin with authentication and allow only a specific CIDR range. Return 403 for unauthorized users and verify rule order with test cases.
Tune concurrency model
Compare prefork, worker, and event MPM for a mixed static + proxied workload. Choose one, justify it, and propose baseline settings for KeepAlive and MaxRequestWorkers.
Zero-downtime config deploy
Design a safe rollout flow: config lint, syntax test, canary VirtualHost, graceful reload, rollback trigger, and post-deploy log checks.
Documentation and sources
- Official Apache HTTP Server 2.4 Docs (httpd.apache.org)
- Module Index (2.4) (httpd.apache.org)
- Virtual Hosts Guide (httpd.apache.org)
- Authentication and Authorization How-To (httpd.apache.org)
- .htaccess Tutorial (httpd.apache.org)
Catalog research notes
- Active 2.4.x branch continues to receive security and bug-fix releases.
- Ongoing hardening and compatibility work for modern TLS/OpenSSL stacks.
- Steady stability updates across core modules like proxying, HTTP/2, and auth.
Connect the ideas
Explore next
Real World Example
Decoupling Legacy Content Delivery via Reverse Proxy
A regional archival library maintaining a legacy document repository that lacks modern security headers and encryption support.
The business problem
The legacy repository runs on an internal server without TLS capabilities, exposing sensitive historical documents to cleartext interception when accessed by remote researchers.
How this topic solves it
Deploying Apache HTTP Server as a reverse proxy layer. By placing Apache in front of the legacy server, the organization can terminate SSL/TLS connections at the proxy, inject required security headers, and forward requests to the internal repository over a secure tunnel, shielding the legacy infrastructure from direct exposure.
- Install the Apache HTTP Server with mod_proxy and mod_ssl modules enabled.
- Configure a VirtualHost to listen on port 443 with valid SSL certificates.
- Define ProxyPass and ProxyPassReverse directives to map public requests to the internal legacy server IP.
- Use Header directives to inject security policies like Strict-Transport-Security.
- Restart the service to apply the proxy configuration and verify the secure handshake.
Visualizes the request path from a remote researcher through the secure proxy to the legacy backend.
Client requesting documents
Terminates TLS and injects headers
Internal document storage
- Researcher → HTTPS Request → Apache Proxy
- Apache Proxy → Proxied HTTP Request → Legacy Repository
Expected business outcome
Researchers can access historical documents via encrypted HTTPS connections, while the legacy repository remains isolated from direct public network traffic.
Limitations and checks
The primary limitation is the increased latency introduced by the proxy hop and the potential for the proxy to become a single point of failure. Administrators can check for this by monitoring the Apache error logs and using system-level tools to track connection timeouts between the proxy and the backend server.