Tosetupavirtualhostwithawildcardaliasforthesubdomainmappedtoasame-nameddirectory,suchas'http://example.com.loc' mapped to `/var/www/example.com`, define the wildcard alias using the [`serveraliases`][] parameter and the document root with the [`virtual_docroot`][] parameter:
Ifyouneedtousethe[ProxySet](http://httpd.apache.org/docs/current/mod/mod_proxy.html#proxyset) directive on the balancer, use the [`proxy_set`](#proxy_set) parameter of `apache::balancer`:
Installsthe[Shibboleth](http://shibboleth.net/) Apache module `mod_shib`, which enables SAML2 single sign-on (SSO) authentication by Shibboleth Identity Providers and Shibboleth Federations. This class only installs and configures the Apache components of a web application that consumes Shibboleth SSO identities, also known as a Shibboleth Service Provider. You can manage the Shibboleth configuration manually, with Puppet, or using a [Shibboleth Puppet Module](https://github.com/aethylred/puppet-shibboleth).
Specifiesan[array][]of[options](http://httpd.apache.org/docs/current/mod/mod_proxy.html#balancermember) after the URL, and accepts any key-value pairs available to [`ProxyPass`][]. Default: an empty array.
If[`apache::mod::passenger`][]isloadedand`PassengerHighPerformance`is'true',the`Alias`directivemightnotbeabletohonorthe`PassengerEnabled=>off`statement.See[thisarticle](http://www.conandalton.net/2010/06/passengerenabled-off-not-working.html) for details.
Alistofhasheswhichcanbeusedtooverridethe[ErrorDocument](https://httpd.apache.org/docs/current/mod/core.html#errordocument) settings for this vhost. Defaults to '[]'. Example:
Setsthe[FallbackResource](http://httpd.apache.org/docs/current/mod/mod_dir.html#fallbackresource) directive, which specifies an action to take for any URL that doesn't map to anything in your filesystem and would otherwise return 'HTTP 404 (Not Found)'. Valid values must either begin with a / or be 'disabled'. Defaults to 'undef'.
#####`filters`
[Filters](http://httpd.apache.org/docs/2.2/mod/mod_filter.html) enable smart, context-sensitive configuration of output content filters.
Addslinestoreplace,merge,orremoveresponseheaders.See[Header](http://httpd.apache.org/docs/current/mod/mod_headers.html#header) for more information. Can be an array. Defaults to 'undef'.
Enablesan[IP-based](http://httpd.apache.org/docs/current/vhosts/ip-based.html) vhost. This parameter inhibits the creation of a NameVirtualHost directive, since those are used to funnel requests to name-based vhosts. Defaults to 'false'.
#####`itk`
Configures[ITK](http://mpm-itk.sesse.net/) in a hash. Keys can be:
Setsthe[ProxyErrorOverrideDirective](http://httpd.apache.org/docs/current/mod/mod_proxy.html#proxyerroroverride). This directive controls whether apache should override error pages for proxied content. This option is off by default.
Setstheoverridesforthespecifiedvirtualhost.Acceptsanarrayof[AllowOverride](http://httpd.apache.org/docs/current/mod/core.html#allowoverride) arguments. Defaults to '[none]'.
#####`passenger_app_root`
Sets[PassengerRoot](https://www.phusionpassenger.com/documentation/Users%20guide%20Apache.html#PassengerAppRoot), the location of the Passenger application root if different from the DocumentRoot.
#####`passenger_app_env`
Sets[PassengerAppEnv](https://www.phusionpassenger.com/documentation/Users%20guide%20Apache.html#PassengerAppEnv), the environment for the Passenger application. If not specifies, defaults to the global setting or 'production'.
#####`passenger_ruby`
Sets[PassengerRuby](https://www.phusionpassenger.com/documentation/Users%20guide%20Apache.html#PassengerRuby) on this virtual host, the Ruby interpreter to use for the application.
#####`passenger_min_instances`
Sets[PassengerMinInstances](https://www.phusionpassenger.com/documentation/Users%20guide%20Apache.html#PassengerMinInstances), the minimum number of application processes to run.
#####`passenger_start_timeout`
Sets[PassengerStartTimeout](https://www.phusionpassenger.com/documentation/Users%20guide%20Apache.html#_passengerstarttimeout_lt_seconds_gt), the timeout for the application startup.
#####`passenger_pre_start`
Sets[PassengerPreStart](https://www.phusionpassenger.com/documentation/Users%20guide%20Apache.html#PassengerPreStart), the URL of the application if pre-starting is required.
#####`php_flags&values`
Allowsper-vhostsetting[`php_value`sor`php_flag`s](http://php.net/manual/en/configuration.changes.php). These flags or values can be overwritten by a user or an application. Defaults to '{}'.
#####`php_admin_flags&values`
Allowsper-vhostsetting[`php_admin_value`sor`php_admin_flag`s](http://php.net/manual/en/configuration.changes.php). These flags or values cannot be overwritten by a user or an application. Defaults to '{}'.
Specifiesthedestinationaddressofa[ProxyPass](http://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypass) configuration. Defaults to 'undef'.
#####`proxy_pass`
Specifiesanarrayof`path=>URI`fora[ProxyPass](http://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypass) configuration. Defaults to 'undef'. Optionally parameters can be added as an array.
Thisdirectiveisequivalenttoproxy_dest,buttakesregularexpressions,see[ProxyPassMatch](http://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypassmatch) for details.
#####`proxy_dest_reverse_match`
AllowsyoutopassaProxyPassReverseif`proxy_dest_match`isspecified.See[ProxyPassReverse](http://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypassreverse) for details.
#####`proxy_pass_match`
Thisdirectiveisequivalenttoproxy_pass,buttakesregularexpressions,see[ProxyPassMatch](http://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypassmatch) for details.
#####`rack_base_uris`
Specifiestheresourceidentifiersforarackconfiguration.Thefilepathsspecifiedarelistedasrackapplicationrootsfor[PhusionPassenger](http://www.modrails.com/documentation/Users%20guide%20Apache.html#_railsbaseuri_and_rackbaseuri) in the _rack.erb template. Defaults to 'undef'.
#####`passenger_base_uris`
UsedtospecifythatthegivenURIisaPhusionPassenger-servedapplication.Thefilepathsspecifiedarelistedaspassengerapplicationrootsfor[PhusionPassenger](https://www.phusionpassenger.com/documentation/Users%20guide%20Apache.html#PassengerBaseURI) in the _passenger_base_uris.erb template. Defaults to 'undef'.
Modifiescollected[requestheaders](http://httpd.apache.org/docs/current/mod/mod_headers.html#requestheader) in various ways, including adding additional request headers, removing request headers, etc. Defaults to 'undef'.
Refertothe[`mod_rewrite`documentation](http://httpd.apache.org/docs/current/mod/mod_rewrite.html) for more details on what is possible with rewrite rules and conditions.
PassesanarrayofhashestothevhosttocreateeitherScriptAliasorScriptAliasMatchstatementsasperthe[`mod_alias`documentation](http://httpd.apache.org/docs/current/mod/mod_alias.html). These hashes are formatted as follows:
Setsupavirtualhostwithawildcardaliassubdomainmappedtoadirectorywiththesamename.Forexample,'http://example.com' would map to '/var/www/example.com'. Defaults to 'false'.
`wsgi_daemon_process`setsthenameoftheWSGIdaemon.Itisahash,accepting[thesekeys](http://modwsgi.readthedocs.org/en/latest/configuration-directives/WSGIDaemonProcess.html), and it defaults to 'undef'.
`wsgi_pass_authorization`theWSGIapplicationhandlesauthorisationinsteadofApachewhensetto'On'.Formoreinformationsee[here](http://modwsgi.readthedocs.org/en/latest/configuration-directives/WSGIPassAuthorization.html). Defaults to 'undef' where apache sets the defaults setting to 'Off'.
The`directories`parameterwithinthe`apache::vhost`classpassesanarrayofhashestothevhosttocreate[Directory](http://httpd.apache.org/docs/current/mod/core.html#directory), [File](http://httpd.apache.org/docs/current/mod/core.html#files), and [Location](http://httpd.apache.org/docs/current/mod/core.html#location) directive blocks. These blocks take the form, '< Directory /path/to/directory>...< /Directory>'.
Sets[AddHandler](http://httpd.apache.org/docs/current/mod/mod_mime.html#addhandler) directives, which map filename extensions to the specified handler. Accepts a list of hashes, with `extensions` serving to list the extensions being managed by the handler, and takes the form: `{ handler => 'handler-name', extensions => ['extension']}`.
Setsan[Allow](http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#allow) directive, which groups authorizations based on hostnames or IPs. **Deprecated:** This parameter is being deprecated due to a change in Apache. It only works with Apache 2.2 and lower. You can use it as a single string for one rule or as an array for more than one.
~~~puppet
apache::vhost{'sample.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
allow=>'fromexample.org',
},
],
}
~~~
######`allow_override`
Setsthetypesofdirectivesallowedin[.htaccess](http://httpd.apache.org/docs/current/mod/core.html#allowoverride) files. Accepts an array.
~~~puppet
apache::vhost{'sample.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
allow_override=>['AuthConfig','Indexes'],
},
],
}
~~~
######`auth_basic_authoritative`
Setsthevaluefor[AuthBasicAuthoritative](https://httpd.apache.org/docs/current/mod/mod_auth_basic.html#authbasicauthoritative), which determines whether authorization and authentication are passed to lower level Apache modules.
######`auth_basic_fake`
Setsthevaluefor[AuthBasicFake](http://httpd.apache.org/docs/current/mod/mod_auth_basic.html#authbasicfake), which statically configures authorization credentials for a given directive block.
######`auth_basic_provider`
Setsthevaluefor[AuthBasicProvider](http://httpd.apache.org/docs/current/mod/mod_auth_basic.html#authbasicprovider), which sets the authentication provider for a given location.
######`auth_digest_algorithm`
Setsthevaluefor[AuthDigestAlgorithm](http://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestalgorithm), which selects the algorithm used to calculate the challenge and response hashes.
######`auth_digest_domain`
Setsthevaluefor[AuthDigestDomain](http://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestdomain), which allows you to specify one or more URIs in the same protection space for digest authentication.
######`auth_digest_nonce_lifetime`
Setsthevaluefor[AuthDigestNonceLifetime](http://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestnoncelifetime), which controls how long the server nonce is valid.
######`auth_digest_provider`
Setsthevaluefor[AuthDigestProvider](http://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestprovider), which sets the authentication provider for a given location.
######`auth_digest_qop`
Setsthevaluefor[AuthDigestQop](http://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestqop), which determines the quality-of-protection to use in digest authentication.
######`auth_digest_shmem_size`
Setsthevaluefor[AuthAuthDigestShmemSize](http://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestshmemsize), which defines the amount of shared memory allocated to the server for keeping track of clients.
######`auth_group_file`
Setsthevaluefor[AuthGroupFile](https://httpd.apache.org/docs/current/mod/mod_authz_groupfile.html#authgroupfile), which sets the name of the text file containing the list of user groups for authorization.
######`auth_name`
Setsthevaluefor[AuthName](http://httpd.apache.org/docs/current/mod/mod_authn_core.html#authname), which sets the name of the authorization realm.
Setsthevaluefor[AuthType](http://httpd.apache.org/docs/current/mod/mod_authn_core.html#authtype), which guides the type of user authentication.
######`auth_user_file`
Setsthevaluefor[AuthUserFile](http://httpd.apache.org/docs/current/mod/mod_authn_file.html#authuserfile), which sets the name of the text file containing the users/passwords for authentication.
Setsa[Deny](http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#deny) directive, specifying which hosts are denied access to the server. **Deprecated:** This parameter is being deprecated due to a change in Apache. It only works with Apache 2.2 and lower. You can use it as a single string for one rule or as an array for more than one.
~~~puppet
apache::vhost{'sample.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
deny=>'fromexample.org',
},
],
}
~~~
######`error_documents`
Anarrayofhashesusedtooverridethe[ErrorDocument](https://httpd.apache.org/docs/current/mod/core.html#errordocument) settings for the directory.
Setsthe[defaultordering](http://httpd.apache.org/docs/current/mod/mod_autoindex.html#indexorderdefault) of the directory index.
~~~puppet
apache::vhost{'sample.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
order=>'Allow,Deny',
index_order_default=>['Descending','Date'],
},
],
}
~~~
######`index_style_sheet`
Setsthe[IndexStyleSheet](http://httpd.apache.org/docs/current/mod/mod_autoindex.html#indexstylesheet) which adds a CSS stylesheet to the directory index.
SetstheorderofprocessingAllowandDenystatementsasper[Apachecoredocumentation](http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order). **Deprecated:** This parameter is being deprecated due to a change in Apache. It only works with Apache 2.2 and lower.
~~~puppet
apache::vhost{'sample.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
order=>'Allow,Deny',
},
],
}
~~~
######`passenger_enabled`
Setsthevalueforthe[PassengerEnabled](http://www.modrails.com/documentation/Users%20guide%20Apache.html#PassengerEnabled) directory to 'on' or 'off'. Requires `apache::mod::passenger` to be included.
~~~puppet
apache::vhost{'sample.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
passenger_enabled=>'on',
},
],
}
~~~
*Note:*Beawarethatthereisan[issue](http://www.conandalton.net/2010/06/passengerenabled-off-not-working.html) using the PassengerEnabled directive with the PassengerHighPerformance directive.
Setsa`Satisfy`directiveasperthe[ApacheCoredocumentation](http://httpd.apache.org/docs/2.2/mod/core.html#satisfy). **Deprecated:** This parameter is being deprecated due to a change in Apache. It only works with Apache 2.2 and lower.
~~~puppet
apache::vhost{'sample.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
satisfy=>'Any',
}
],
}
~~~
######`sethandler`
Setsa`SetHandler`directiveasperthe[ApacheCoredocumentation](http://httpd.apache.org/docs/2.2/mod/core.html#sethandler). An example:
Allowsanvalidcontentsettingtobesetoralteredfortheapplicationrequest.Thiscommandtakestwoparameters,thenameofthecontentsetting,andthevaluetosetitto.ChecktheShibboleth[contentsettingdocumentation](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings) for valid settings. This key is disabled if `apache::mod::shib` is not defined. Check the [`mod_shib` documentation](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig#NativeSPApacheConfig-Server/VirtualHostOptions) for more details.
~~~puppet
apache::vhost{'secure.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
shib_request_settings=>{'requiresession'=>'On'},
shib_use_headers=>'On',
},
],
}
~~~
######`shib_use_headers`
Whensetto'On'thisturnsontheuseofrequestheaderstopublishattributestoapplications.Validvaluesforthiskeyis'On'or'Off',andthedefaultvalueis'Off'.Thiskeyisdisabledif`apache::mod::shib`isnotdefined.Checkthe[`mod_shib`documentation](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig#NativeSPApacheConfig-Server/VirtualHostOptions) for more details.
######`ssl_options`
Stringorlistof[SSLOptions](https://httpd.apache.org/docs/current/mod/mod_ssl.html#ssloptions), which configure SSL engine run-time options. This handler takes precedence over SSLOptions set in the parent block of the vhost.
~~~puppet
apache::vhost{'secure.example.net':
docroot=>'/path/to/directory',
directories=>[
{path=>'/path/to/directory',
ssl_options=>'+ExportCertData',
},
{path=>'/path/to/different/dir',
ssl_options=>['-StdEnvVars','+ExportCertData'],
},
],
}
~~~
######`suphp`
Ahashcontainingthe'user'and'group'keysforthe[suPHP_UserGroup](http://www.suphp.org/DocumentationView.html?file=apache/CONFIG) setting. It must be used with `suphp_engine => on` in the vhost declaration, and can only be passed within `directories`.
Specifies[SSLProtocol](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslprotocol). Expects an array of accepted protocols. Defaults to 'all', '-SSLv2', '-SSLv3'.
#####`ssl_cipher`
Specifies[SSLCipherSuite](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslciphersuite). Defaults to 'HIGH:MEDIUM:!aNULL:!MD5'.
#####`ssl_honorcipherorder`
Sets[SSLHonorCipherOrder](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhonorcipherorder), which is used to prefer the server's cipher preference order. Defaults to 'On' in the base `apache` config.
Setsthecertificaterevocationchecklevelviathe[SSLCARevocationCheckdirective](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcarevocationcheck), defaults to 'undef'. This default works out of the box but must be specified when using CRLs in production. Only applicable to Apache 2.4 or higher; the value is ignored on older versions.
Setsthe[SSLVerifyClient](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslverifyclient) directive, which sets the certificate verification level for client authentication. Valid values are: 'none', 'optional', 'require', and 'optional_no_ca'. Defaults to 'undef'.
~~~puppet
apache::vhost{'sample.example.net':
…
ssl_verify_client=>'optional',
}
~~~
#####`ssl_verify_depth`
Setsthe[SSLVerifyDepth](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslverifydepth) directive, which specifies the maximum depth of CA certificates in client certificate verification. Defaults to 'undef'.
~~~puppet
apache::vhost{'sample.example.net':
…
ssl_verify_depth=>1,
}
~~~
#####`ssl_proxy_machine_cert`
Setsthe[SSLProxyMachineCertificateFile](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxymachinecertificatefile) directive, which specifies an all-in-one file where you keep the certs and keys used for this server to authenticate itself to remote servers. This file should be a concatenation of the PEM-encoded certificate files in order of preference. Defaults to 'undef'.
Setsthe[SSLOptions](http://httpd.apache.org/docs/current/mod/mod_ssl.html#ssloptions) directive, which configures various SSL engine run-time options. This is the global setting for the given vhost and can be a string or an array. Defaults to 'undef'.
Setsthe[SSLOpenSSLConfCmd](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslopensslconfcmd) directive, which provides direct configuration of OpenSSL parameters. Defaults to 'undef'.
#####`ssl_proxyengine`
Specifieswhetherornottouse[SSLProxyEngine](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxyengine). Valid values are 'true' and 'false'. Defaults to 'false'.