转载自 http://olex.openlogic.com/wazi/2009/installing-apache-http-server-with-quick-start-config/
The Apache HTTP Server has been the most popular web server on the Internet since April 1996 and is one of the most widely used open source software packages. In fact, the latest Netcraft Web Server Survey reports that more than half of all active web sites use Apache, making it more widely used than all other Web servers combined. So it’s no surprise that we get lots of questions about Apache HTTP Server installation procedures. Fortunately, we have tons of experience with Apache installations, and we’ve distilled our years of experience into this handy tutorial.
Before You Start
This article assumes that you have Red Hat/CentOS Linux with a proper build environment setup. If you do not have GCC installed you can get this with all the required packages like this:
yum groupinstall "Development Libraries"
You should now be ready to install Apache!
Meat & Potatoes
When we install Apache HTTP Server either for ourselves a client — small or large — we follow a “standard” configuration setup that’s very easy to build on later. For the most part we use CentOS or Red Hat Enterprise edition servers, but these steps should work on any Unix system. This might not be true for AIX, which requires a little more hand-holding to make sure the compiler is installed correctly.
The steps we’ll cover in this article are:
- Download the source code for the latest version of Apache (currently 2.2.11) from OpenLogic Exchange (OLEX) or the Apache project website.
- Execute the configure, make, and make install installation steps (with a few custom switches).
- Setup the httpd.conf and associated files.
- Start your newly built Apache server.
- Done!
Download Apache
The first step is to download the Apache source code, not binaries or RPMs. We believe that using the source code gives the best performing, most flexible installation of Apache. If you follow a few simple steps the actual “installation” procedure is not difficult, and you’ll have a good foundation to add or remove features later.
To download the source source code, go to OpenLogic Exchange (OLEX) or the Apache downloads site and look for the latest ZIP, TGZ, or BZ2 file (currently version 2.2.11).
Compiling/Installing the Source for Apache
We like to keep our source downloads in ~/Software/ so it’s easy go back and re-compile and re-install the binaries if we need to add a module or two. With the source saved under ~/Software/httpd-2.2.11, compile Apache HTTP Server with the following configure string:
[root@coco ~]# cd ~/Software/httpd-2.2.11 [root@coco httpd-2.2.11]# "./configure" "--enable-ssl" "--enable-proxy" "--enable-proxy-balancer" "--enable-rewrite" "--enable-headers" "--enable-deflate" "--enable-cache" "--enable-expires" "--enable-mem-cache" "--enable-disk-cache" "--enable-file-cache" "--with-mpm=worker" "--disable-cgi --disable-asis" "--disable-autoindex" "--disable-userdir"
Here’s a brief explanation of the configuration options shown above:
- enable-ssl: This will allow you to enable a secure port later.
- enable-proxy/enable-proxy-balancer: This will setup a connection to a back-end server like Tomcat or Mongrel
- enable-rewrite: We’re always going to need rewrite rules in the config file.
- enable-headers: We need this to enable monitoring of the server, and for mod_proxy we need to manipulate the header.
- enable-deflate: Enables the old gzip module, which will allow us to setup some content to be compressed with gzip.
- enable-cache/expires/mem-cache/disk-cache/file-cache: These are all included so we can enable the expires module.
- with-mpm=worker: We’re choosing to use the worker MPM as the default since most servers we work with have more than one CPU. Use the prefork MPM if you’re working on a server that has only one CPU.
Next, run the following to install Apache HTTP Server:
[root@coco httpd-2.2.11]# make && make install
The Apache server should now be installed in /usr/local/apache2, which is the default installation directory. To change the Apache installation directory you’ll need to add the –prefix=/my/directory/apache2 switch to the configure string, and then run the make && make install command as shown above.
Apache Startup Script
The easiest and fastest way to start Apache is to copy /usr/local/apache2/bin/apachectl to /etc/init.d/apache. This will allow you to do /etc/init.d/apache start|stop|restart.
If you want a script that has more feedback you can use the following:
#!/bin/bash
# httpd Startup script for the Apache HTTP Server
# chkconfig: 2345 85 15
# description: Apache is a World Wide Web server. It is used to serve
# HTML files and CGI.
# processname: httpd
# config: /usr/local/apache2/conf/httpd.conf
# pidfile: /var/run/apache2.pid
# Source function library.
. /etc/rc.d/init.d/functions
# Start httpd in the C locale by default.
HTTPD_LANG=${HTTPD_LANG-"C"}
# This will prevent initlog from swallowing up a pass-phrase prompt if
# mod_ssl needs a pass-phrase from the user.
INITLOG_ARGS=""
# Path to the apachectl script, server binary, and short-form for messages.
apachectl=/usr/local/apache2/bin/apachectl
httpd=${HTTPD-/usr/local/apache2/bin/httpd}
prog=httpd
pidfile=${PIDFILE-/var/run/apache2.pid}
lockfile=${LOCKFILE-/var/lock/subsys/apache2}
RETVAL=0
start() {
echo -n $"Starting $prog: "
LANG=$HTTPD_LANG daemon $httpd $OPTIONS
RETVAL=$?
echo
[ $RETVAL = 0 ] && touch ${lockfile}
return $RETVAL
}
stop() {
echo -n $"Stopping $prog: "
killproc $httpd
RETVAL=$?
echo
[ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile}
}
reload() {
echo -n $"Reloading $prog: "
if ! LANG=$HTTPD_LANG $httpd $OPTIONS -t >&/dev/null; then
RETVAL=$?
echo $"not reloading due to configuration syntax error"
failure $"not reloading $httpd due to configuration syntax error"
else
killproc $httpd -HUP
RETVAL=$?
fi
echo
}
# See how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status $httpd
RETVAL=$?
;;
restart)
stop
start
;;
condrestart)
if [ -f ${pidfile} ] ; then
stop
start
fi
;;
reload)
reload
;;
graceful|help|configtest|fullstatus)
$apachectl $@
RETVAL=$?
;;
*)
echo $"Usage: $prog {start|stop|restart|condrestart|reload|status|fullstatus|graceful|help|configtest}"
exit 1
esac
exit $RETVAL
Apache Configuration File
The main configuration file we use as a template for Apache servers has a few different sections that are important to understand.
# =================================================
# Basic Settings
# =================================================
ServerName %{SERVER_NAME}
ServerRoot "/usr/local/apache2"
PidFile "/var/run/apache2.pid"
# =================================================
# Performance Settings
# =================================================
Timeout 30
KeepAlive On
MaxKeepAliveRequests 500
KeepAliveTimeout 2
<IfModule mpm_prefork_module>
StartServers 1
MinSpareServers 1
MaxSpareServers 10
MaxClients 25
MaxRequestsPerChild 1000
</IfModule>
<IfModule mpm_worker_module>
ServerLimit 16
StartServers 2
MaxClients 40
MinSpareThreads 5
MaxSpareThreads 20
ThreadsPerChild 20
MaxRequestsPerChild 5000
</IfModule>
The Basic Settings section just defines the root directory of Apache, but the Performance Settings section has a few noteworthy options. We have a Timeout of 30 seconds, which is enough for most setups (the default of 300 is way too long). We enable KeepAlive, but the KeepAlive timeout is only 2 seconds. This allows each user to get their own connection, but the connection will close as soon as they download the page they requested (you can play with this timeout, but you’ll most likely want to have it set somewhere in the 1-5 sec range). Next, we setup prefork and worker based on the number of CPUs that are installed on the Apache server.
# ================================================= # General Settings # ================================================= Listen 80 # Listen 443 User www Group www ServerAdmin webmaster@openlogic.com UseCanonicalName Off ServerTokens Prod ServerSignature Off HostnameLookups Off ExtendedStatus On # ================================================= # Modules # ================================================= #LoadModule dummy_module /usr/lib/apache2/modules/mod_dummy.so
In the General Settings section we set Listen to port 80, but we also have port 443 as an option to choose from (we’ll show you how to setup a https/SSL/secure virtual host later). User and Group are set to the www user, which is a system user (note that on Red Hat you create a system user with the -r switch adduser -r www). We don’t want the server to look up hostname or show a signature to our users, so those options are disabled. The ExtendedStatus option is enabled for monitoring reasons. And in the Modules section, the dummy module is there in case we want to install PHP later on.
# ================================================= # Access Control # ================================================= <Directory /> Options FollowSymLinks AllowOverride None Order deny,allow Deny from all </Directory> <DirectoryMatch "^/.*/.svn/"> ErrorDocument 403 /404.html Order allow,deny Deny from all Satisfy All </DirectoryMatch> <FilesMatch "^.ht"> Order allow,deny Deny from all Satisfy All </FilesMatch> # ================================================= # MIME Encoding # ================================================= DefaultType text/plain TypesConfig conf/mime.types AddType application/x-compress .Z AddType application/x-gzip .gz .tgz AddType application/x-x509-ca-cert .crt AddType application/x-pkcs7-crl .crl
Needless to say, the Access Control section contains some important options. Deny from all makes sure we have to allow access to any directory that’s used in the Apache configuration. Then, we make sure that users don’t have access to .svn directories or .ht files. In the MIME Encoding section we have a minimal mime.type setup for the deflate and SSL modules.
# =================================================
# Logs
# =================================================
LogLevel warn
LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined
ErrorLog /usr/local/apache2/logs/error_log
# Mark requests for the robots.txt file
SetEnvIf Request_URI "^/robots.txt$" dontlog
SetEnvIf Request_URI "^/monit/token$" dontlog
# =================================================
# SSL Configuration
# =================================================
SSLPassPhraseDialog builtin
SSLSessionCache shmcb:/usr/local/apache2/logs/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLMutex file:/usr/local/apache2/logs/ssl_mutex
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
Next, we setup the LogFormat for use in our virtual hosts and the server error log file. We also have two dontlog Env settings to remove the robot.txt and monit/token hits from the log. (We’ll show how this is used when we create the virtual host.) We also setup a default SSL configuration for the server.
# ================================================= # Mod Status for Monitoring # ================================================= <VirtualHost 127.0.0.1:80> <Location /server-status> SetHandler server-status Order Deny,Allow Deny from all Allow from localhost Allow from 127.0.0.1 </Location> </VirtualHost> # ================================================= # Include Extra Configs # ================================================= Include conf/extra/httpd-myblog.com.conf
In the Mod Status for Monitoring section we get to the server monitoring setup. We start by allowing only access from localhost, and we specify that it will only listen to the 127.0.0.1 IP. This is a good setup for tools like GroundWork and Hyperic. The last line includes a virtual host configuration file. Now let’s have a look at the virtual host.
Virtual Hosts Using a Name-Based Setup
We like to configure our httpd.conf with server-wide settings while keeping it free of actual content hosting elements or mod_proxy/mod_jk configurations. In this example we have a blog that’s running on a Ruby on Rails back-end with three Thin servers listening to ports 8000-8002 (Thin an application server that can be used for RoR as an alternative to Tomcat or Mongrel).
# -------------------------------------------------------- # Always Keep the Host Header # -------------------------------------------------------- ProxyPreserveHost On # -------------------------------------------------------- # Rails Cluster # -------------------------------------------------------- <Proxy balancer://rails-cluster> BalancerMember http://127.0.0.1:8000 BalancerMember http://127.0.0.1:8001 BalancerMember http://127.0.0.1:8002 </Proxy>
This setup has three servers in a proxy_balancer cluster that you can access using balancer://rails-cluster/ just as though it was one server.
# --------------------------------------------------------
# Name-Based Virtual Hosting
# --------------------------------------------------------
NameVirtualHost *:80
<VirtualHost *:80>
DocumentRoot "/var/www/myblog.com/current/public"
ServerName www.myblog.com
ServerAlias myblog.com
# -------------------------------------------------
# Rewrite Rules
# -------------------------------------------------
RewriteEngine on
# Force www.myblog.com and make sure we use a 301 HTTP code for the
# redirect. This is a SEO must.
RewriteCond %{HTTP_HOST} !^www.myblog.com [NC]
RewriteCond %{HTTP_HOST} !^$
RewriteRule ^/(.*) http://www.myblog.com/$1 [L,R=301]
# --------------------------------------------------------
# List of URLs Not to Proxy
# --------------------------------------------------------
ProxyPass /system !
ProxyPass /images !
ProxyPass /stylesheets !
ProxyPass /javascripts !
ProxyPass /monit/token !
# Send everything else to the proxy_balancer cluster of rails servers
ProxyPass / balancer://rails-cluster/
ProxyPassReverse / balancer://rails-cluster/
<Directory "/var/www/myblog.com/current/public">
Options FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
# Before you restart the server you need to create the logs/myblog.com
# directory.
# We are also adding the dontlog environment variable here to stop
# logging the set entries. (This is configured in your httpd.conf)
ErrorLog "logs/myblog.com/error_log"
CustomLog "logs/myblog.com/access_log" combined env=!dontlog
# --------------------------------------------------------
# Deflate Module Configuration
# --------------------------------------------------------
<IfModule deflate_module>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE image/svg+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/atom_xml
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE application/x-httpd-php
AddOutputFilterByType DEFLATE application/x-httpd-fastphp
AddOutputFilterByType DEFLATE application/x-httpd-eruby
AddOutputFilterByType DEFLATE text/html
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
</IfModule>
# =============================================
# Configure Expires Module
# =============================================
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 1 seconds"
ExpiresByType text/html "access plus 1 seconds"
ExpiresByType image/gif "access plus 1 week"
ExpiresByType image/jpeg "access plus 1 week"
ExpiresByType image/png "access plus 1 week"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/javascript "access plus 1 week"
ExpiresByType application/x-javascript "access plus 1 week"
ExpiresByType text/xml "access plus 1 seconds"
</IfModule>
</VirtualHost>
There’s a lot of information here, so lets take it step by step. First, we setup a server with the name www.myblog.com that also listens to myblog.com, but by using mod_rewrite we force everyone to www.myblog.com with a 301 redirect. Next, we setup all of the static content that we want Apache to serve from the local file system using ProxyPass with a ! to say “do not proxypass” these directories, and then we send everything else to the balancer cluster. We setup the access rights to the static directory where our content (like images, JavaScript, uploaded files, and CSS) is stored. Then, we setup the virtualhosts log file in its own directory inside the logs directory. The mod_deflate and mod_expires configurations work for most setups, but this piece needs to be monitored and tuned to your setup. We’ve seen the mod_expires setup cause problems using Rails and authentication.
Now, off to a secure.myblog.com virtual host:
<VirtualHost _default_:443>
DocumentRoot "/var/www/myblog.com/current/public"
ServerName secure.myblog.com
ServerAlias www.myblog.com myblog.com
RewriteCond %{HTTP_HOST} !^secure.myblog.com [NC]
RewriteCond %{HTTP_HOST} !^$
RewriteRule ^/(.*) https://secure.myblog.com/$1 [L,R=301]
# --------------------------------------------------------
# List of URLs Not to Proxy
# --------------------------------------------------------
ProxyPass /system !
ProxyPass /images !
ProxyPass /stylesheets !
ProxyPass /javascripts !
ProxyPass / balancer://rails-cluster/
ProxyPassReverse / balancer://rails-cluster/
ErrorLog "logs/myblog.com/error_log"
CustomLog "logs/myblog.com/access_log" combined env=!donlog
# --------------------------------------------------------
# SSL Certificates
# --------------------------------------------------------
SSLEngine on
SSLCertificateFile /usr/local/apache2/ssl/secure.myblog.com.crt
SSLCertificateKeyFile /usr/local/apache2/ssl/secure.myblog.com.key
# --------------------------------------------------------
# Deflate Module Configuration
# --------------------------------------------------------
<IfModule deflate_module>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE image/svg+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/atom_xml
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE application/x-httpd-php
AddOutputFilterByType DEFLATE application/x-httpd-fastphp
AddOutputFilterByType DEFLATE application/x-httpd-eruby
AddOutputFilterByType DEFLATE text/html
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
</IfModule>
# =============================================
# Configure Expires Module
# =============================================
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 1 seconds"
ExpiresByType text/html "access plus 1 seconds"
ExpiresByType image/gif "access plus 1 week"
ExpiresByType image/jpeg "access plus 1 week"
ExpiresByType image/png "access plus 1 week"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/javascript "access plus 1 week"
ExpiresByType application/x-javascript "access plus 1 week"
ExpiresByType text/xml "access plus 1 seconds"
</IfModule>
# --------------------------------------------------------
# Document Root /
# --------------------------------------------------------
<Directory "/var/www/myblog.com/current/public">
Options FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
# -------------------------------------------------
# Fixing Yet Another IE 6 Bug
# -------------------------------------------------
BrowserMatch ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
# -------------------------------------------------
# Add this to the request header so that
# Rails puts the correct redirect in place
# -------------------------------------------------
RequestHeader set X_FORWARDED_PROTO 'https'
</VirtualHost>
This is very similar to the port 80 virtual host of the same name. The biggest difference is with the SSL certificates and the bottom SSL/https settings to fix issues with Mongrel/Rails and IE6. You can’t configure mod_expires and mod_deflate in the main configuration file and have the virtual host inheret the configuration, so the best solution to be dry is to put these settings in their own mod_deflate.conf and mod_expires.conf and then include the named configuration files in each virtualhosts configuration file like so:
Include conf/mod_deflate.conf Include conf/mod_expires.conf
Finishing Up
Apache with mod_proxy rocks. After working through the above steps we have an Apache installation that is ready to be expanded to a high performance web server or proxy server, or both. We like to start with this setup and then build from here. If you need to get more concurrent clients and throughput on your Apache server, take a look at your available memory and CPU cycles and consider doing something like this:
<IfModule mpm_worker_module> ThreadLimit 100 StartServers 5 MaxClients 1000 MinSpareThreads 100 MaxSpareThreads 1000 ThreadsPerChild 100 MaxRequestsPerChild 0 </IfModule>
This is a high threads and low processes setup, and to get the number of processes that Apache will use simply divide MaxClients by ThreadPerChild. So, this gives us 10 processes each with a maximum of 100 threads, with a maximum of 1000 clients total. Depending on the server and type of content that you are serving you can load test and increase these settings if you need more than 1000 concurrent users.
We’re very big fans of mod_proxy, and we use mod_proxy_ajp in place of mod_jk every chance we get. We also talk a lot of customers into using mod_proxy over mod_jk if they’re using Apache 2.2.x.
Using this setup to include the virtual hosts that the server runs, it’s easy to add and remove new websites. It also provides a good overview of what’s running on the server.
