Apache HTTP Server

Synopsis #

The Apache HTTP Server supports virtual hosts, authentication, TLS, CGI, PHP, and dynamically loaded modules.

Apache is not included in the OpenBSD base system. It is available as a package under the name www/apache-httpd.

Web Server History on OpenBSD #

OpenBSD removed the old Apache server from base in 5.6, introduced the native httpd in 5.6, and removed nginx from base in 5.7. Apache and nginx remain available as packages. See the 5.6 release notes and 5.7 release notes .

Web Server Comparison #

The Web overview compares httpd, nginx, and Apache and explains the separate role of relayd.

Installation #

Package versions and dependencies are available in the release package and current package entries. The package branch must match the installed OpenBSD system.

Apache is installed via the package system:

doas pkg_add apache-httpd

This provides the Apache 2.4 binary, modules, configuration templates, and startup script.

Configuration #

Apache’s primary configuration file is:

/etc/apache2/httpd2.conf

The directory /etc/apache2/ also includes subdirectories for optional configurations:

  • extra/ — supplementary virtual host and module settings
  • original/ — saved reference defaults

To begin, create a simple virtual host configuration:

ServerRoot "/var/www"
Listen 80

LoadModule mpm_prefork_module /usr/local/lib/apache2/mod_mpm_prefork.so
LoadModule dir_module /usr/local/lib/apache2/mod_dir.so
LoadModule mime_module /usr/local/lib/apache2/mod_mime.so
TypesConfig /etc/apache2/mime.types
LoadModule log_config_module /usr/local/lib/apache2/mod_log_config.so
LoadModule alias_module /usr/local/lib/apache2/mod_alias.so
LoadModule authz_core_module /usr/local/lib/apache2/mod_authz_core.so
LoadModule unixd_module /usr/local/lib/apache2/mod_unixd.so
LoadModule rewrite_module /usr/local/lib/apache2/mod_rewrite.so

User www
Group www

DocumentRoot "/htdocs"
<Directory "/htdocs">
    Require all granted
    Options Indexes FollowSymLinks
    AllowOverride None
</Directory>

ErrorLog "/var/log/apache2-error.log"
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog "/var/log/apache2-access.log" common

Keep ServerRoot at /var/www, the package default. The default PID-file path depends on this directory. Use DocumentRoot to set the directory for site files.

Create the document root and test file:

doas sh <<'ROOT'
mkdir -p /htdocs
echo 'OK' > /htdocs/index.html
chown -R www:www /htdocs
ROOT

Starting Apache #

The package supplies the apache2 service and the httpd2 binary. Validate and start it with:

doas /usr/local/sbin/httpd2 -t
doas rcctl enable apache2
doas rcctl start apache2

Ensure the selected ports are not already used by base httpd, nginx, or relayd. Preserve package module defaults unless replacing them deliberately.

TLS Support #

Apache supports HTTPS via mod_ssl.

Add the following to /etc/apache2/httpd2.conf:

LoadModule ssl_module /usr/local/lib/apache2/mod_ssl.so

Listen 443
<VirtualHost _default_:443>
    DocumentRoot "/htdocs"
    SSLEngine on
    SSLCertificateFile "/etc/ssl/example.crt"
    SSLCertificateKeyFile "/etc/ssl/private/example.key"
</VirtualHost>

Ensure the certificate and key exist:

doas ls -l /etc/ssl/example.crt /etc/ssl/private/example.key

You may use Let’s Encrypt and acme-client(1) to obtain valid certificates.

Restart Apache after enabling TLS:

doas /usr/local/sbin/httpd2 -t && doas rcctl restart apache2

Access Logs #

Apache logs access and error information by default:

  • /var/log/apache2-access.log
  • /var/log/apache2-error.log

To view:

doas tail -f /var/log/apache2-access.log

Module Management #

Apache supports many modules. Common examples include:

  • mod_rewrite — URL rewriting
  • mod_alias — aliasing paths
  • mod_cgi — running shell scripts or compiled CGI
  • mod_php — dynamic PHP integration
  • mod_proxy — reverse proxy capabilities

Modules must be loaded via LoadModule in httpd.conf. Paths refer to .so files under /usr/local/lib/apache2.

Security Notes #

Apache runs as the unprivileged www user. Ensure content files are owned appropriately and do not grant write access to system users.

Example:

doas chown -R www:www /htdocs
doas chmod -R o-rwx /htdocs/private

Avoid enabling .htaccess (AllowOverride) unless explicitly needed.

Use pf.conf to restrict access to port 80/443 as needed:

pass in on $int_if proto tcp from any to (self) port {80 443}
Report a bug