diff --git a/defaults/main.yml b/defaults/main.yml
index 231756a..84ee745 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,6 +1,6 @@
 ---
 apache_service_enabled: True
-apache_user: www-data
+apache_user: '{% if ansible_distribution_file_variety == "Debian" %}www-data{% else %}apache{% endif %}'
 apache_pkg_state: present
 apache_group: '{{ apache_user }}'
 apache_from_ppa: False
@@ -13,12 +13,24 @@ apache_listen_ports:
 # Possible choices: event, prefork (the old ones), worker (the threaded version), itm
 apache_mpm_mode: worker
 
-apache_packages:
+apache_packages: "{{ apache_deb_packages if ansible_distribution_file_variety == 'Debian' else apache_el_packages }}"
+apache_deb_packages:
   - apache2
   - apache2-utils
   - libapache2-mod-xsendfile
   - unzip
   - zip
+apache_el_packages:
+  - httpd
+  - httpd-tools
+# EL only: mod_ssl is a separate package, on deb it is part of apache2
+apache_ssl_packages:
+  - mod_ssl
+
+apache_service_name: '{% if ansible_distribution_file_variety == "Debian" %}apache2{% else %}httpd{% endif %}'
+apache_base_conf_dir: '{% if ansible_distribution_file_variety == "Debian" %}/etc/apache2{% else %}/etc/httpd{% endif %}'
+apache_base_document_root: '{% if ansible_distribution_file_variety == "Debian" %}/var/www{% else %}/var/www{% endif %}'
+apache_document_root: '{{ apache_base_document_root }}/html'
 
 apache_modules_packages:
   - 'apache2-mpm-{{ apache_mpm_mode }}'
@@ -62,7 +74,7 @@ apache_info_allowed_hosts:
 
 apache_basic_auth: False
 apache_basic_auth_single_file: True
-apache_basic_auth_dir: /etc/apache2/auth
+apache_basic_auth_dir: '{{ apache_base_conf_dir }}/auth'
 apache_basic_auth_file: '{{ apache_basic_auth_dir }}/htpasswd'
 
 apache_basic_auth_modules:
@@ -91,3 +103,52 @@ apache_letsencrypt_proxy_modules:
 
 apache_letsencrypt_proxy_conf:
   - letsencrypt-proxy.conf
+
+#
+# EL only settings. They come from the httpd role this one absorbs, renamed from
+# httpd_* to apache_*: on EL the whole httpd.conf is templated, while on deb the
+# packaged apache2.conf is left alone and only ports.conf and the modules are
+# managed.
+#
+apache_server_admin: root@localhost
+apache_base_document_root_override: 'None'
+apache_base_document_root_access: 'denied'
+apache_document_root_options: 'Indexes FollowSymLinks'
+apache_document_root_override: 'None'
+apache_document_root_access: 'granted'
+
+apache_cgi_enabled: False
+apache_sendfile_enabled: 'on'
+apache_mmap_enabled: 'on'
+apache_use_canonicalname: 'off'
+# The httpd role this one absorbs used OS. Prod is the safer value, but changing
+# it here would be a silent change for every host that inherits the default.
+apache_servertokens: 'OS'
+apache_hostname_lookups: 'off'
+apache_default_charset: 'UTF-8'
+apache_languages:
+  - en
+  - it
+
+apache_timeout: 60
+apache_keepalive_enabled: True
+apache_keepalive_timeout: 5
+apache_keepalive_requests: 100
+
+# MPM tuning, used by the EL httpd.conf template
+apache_startservers: 8
+apache_maxclients: 300
+apache_min_spare: 25
+apache_max_spare: 75
+apache_max_requests_per_child: 0
+apache_threads_per_child: 25
+apache_serverlimit: 256
+
+# Modules on EL are not managed with a2enmod: the apache2_module Ansible module
+# requires the a2enmod and a2dismod binaries, which the EL httpd package does not
+# ship, so the module list of the old role could never be applied there. What EL
+# actually needs is the MPM selection, written into conf.modules.d/00-mpm.conf,
+# plus an optional file for modules the distribution does not load by default.
+# Every entry is emitted as: LoadModule <identifier> modules/<file>
+apache_el_extra_modules: []
+#  - { identifier: 'jk_module', file: 'mod_jk.so' }