For context: I'm using a Debian or Ubuntu server with Apache 2.4, PHP 7.2 and a number of other things, to set up a development and testing environment for devs and technicians to use at work.

I've followed the tutorial on mass virtualhost using mod_vhost_alias so that I can get stuff like this:

path: /var/www/{projectname}/public
url: {projectname}.dev.mycompany.net

The relevant configuration is as follows (adequately edited)

        VirtualDocumentRoot /var/www/%-4/public
        ServerName dev.mycompany.net
        ServerAlias *.dev.mycompany.net
        UseCanonicalName Off

Now, this is all working correctly and devs can easily kickstart their own projects by requesting an user; the user is created and added to www-data group and then the adequate folders are created in /var/www with a structure like this:

projectname:projectname  rwxrwxr-x  /var/www/projectname
www-data:www-data     rwxrwsr-x  /var/www/projectname/public 

setfacl -m user:www-data:rwx /var/www/projectname
setfacl -R -m user:projectname:rwx /var/www/projectname/public 

(the latter was needed so files created by eg.: installed frameworks or unzippers could actually be handled by the webserver)

Of course this has the disadvantage that any project can write stuff into any other project, so I want to work on that. However I want to, where possible, keep the automation, since the devs and technicians should be able to kickstart projects with the minimum possible input from backend on the matter ("Distracting backend is for later" said the boss).

Now, for making things secure but still trying to keep them simple, what I want is to setup Apache (or PHP?) so that the adequate user is used to execute the webserver / PHP process corresponding to each virtualhost. That means that eg.: project /var/www/foo1 runs under user foo1 and does not have access to files under /var/www/foo2. Of course I expect to adapt permissions and ACL to that.

But I can not find any documentation on how to set up separate users while keeping around the automation for mass virtual host. I presume this has to exist - hosting companies would do stuff like this after all. But I've looked into a number of stuff and nothing seems to offer an alternative that works.

At most, I've been guided to apache2-mod-itk, but once installed the webserver will always fail to start no matter what, even when defaulting most conf files to default configuration, so it's not an option.

What I'm looking for is for something that would have the effect similar to this Apache config "pseudocode":

<Virtualhost *:443> 
        VirtualDocumentRoot /var/www/%-4/public
        ServerName dev.mycompany.net
        ServerAlias *.dev.mycompany.net
        UseCanonicalName Off
        User %-4
        Group %-4
        SuexecUserGroup %-4
        CustomLog /var/www/%-4/logs/access.log vcommon

[...other directives]


Is there something like this available in Apache/+PHP, or should I be looking for other sort of automated solution?

Note that I don't want to end up separating the entire thing into eg.: a docker or VM for each user unless there is a plain- mass_vhosts-like way to automatize the setup; that would require even more input (not to mention giving the technicians root(?) permission to run and install docker containers) and also break the automation going on (how do you connect the subdomains to the containers dynamically?).


You must log in to answer this question.

Browse other questions tagged .