From 2ec983c1dad5dddd2cc4bfcb46b2edca677eed0f Mon Sep 17 00:00:00 2001
From: Andrea Dell'Amico <andrea.dellamico@isti.cnr.it>
Date: Fri, 4 Sep 2026 19:54:37 +0000
Subject: [PATCH] defaults: one apache_* namespace for both families

The collection had two roles for the same service: this one, deb only, and an EL
only 'httpd' role in a library that is no longer maintained.

The namespace is apache_*. The httpd_* names are gone rather than aliased: an
alias that silently stops matching is the failure mode this merge is meant to
remove. httpd_main_packages becomes apache_packages, httpd_ssl_enabled becomes
apache_ssl_modules_enabled, everything else is a mechanical rename.

Packages, service name, config directory, user and group carry the distribution
test inside the default itself, the convention already used by the postgresql
role, so they stay overridable from host_vars and group_vars. The package list
uses a single Jinja expression rather than an {% if %} block, which would render
the list as its repr.

apache_servertokens keeps the value the absorbed role used, OS, rather than the
safer Prod: changing it here would be a silent change for every host that
inherits the default.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sTDubHhviDWKZLtAtZXTW
---
 defaults/main.yml | 67 ++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 64 insertions(+), 3 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index 231756a..84ee745 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,6 +1,6 @@
 ---
 apache_service_enabled: True
-apache_user: www-data
+apache_user: '{% if ansible_distribution_file_variety == "Debian" %}www-data{% else %}apache{% endif %}'
 apache_pkg_state: present
 apache_group: '{{ apache_user }}'
 apache_from_ppa: False
@@ -13,12 +13,24 @@ apache_listen_ports:
 # Possible choices: event, prefork (the old ones), worker (the threaded version), itm
 apache_mpm_mode: worker
 
-apache_packages:
+apache_packages: "{{ apache_deb_packages if ansible_distribution_file_variety == 'Debian' else apache_el_packages }}"
+apache_deb_packages:
   - apache2
   - apache2-utils
   - libapache2-mod-xsendfile
   - unzip
   - zip
+apache_el_packages:
+  - httpd
+  - httpd-tools
+# EL only: mod_ssl is a separate package, on deb it is part of apache2
+apache_ssl_packages:
+  - mod_ssl
+
+apache_service_name: '{% if ansible_distribution_file_variety == "Debian" %}apache2{% else %}httpd{% endif %}'
+apache_base_conf_dir: '{% if ansible_distribution_file_variety == "Debian" %}/etc/apache2{% else %}/etc/httpd{% endif %}'
+apache_base_document_root: '{% if ansible_distribution_file_variety == "Debian" %}/var/www{% else %}/var/www{% endif %}'
+apache_document_root: '{{ apache_base_document_root }}/html'
 
 apache_modules_packages:
   - 'apache2-mpm-{{ apache_mpm_mode }}'
@@ -62,7 +74,7 @@ apache_info_allowed_hosts:
 
 apache_basic_auth: False
 apache_basic_auth_single_file: True
-apache_basic_auth_dir: /etc/apache2/auth
+apache_basic_auth_dir: '{{ apache_base_conf_dir }}/auth'
 apache_basic_auth_file: '{{ apache_basic_auth_dir }}/htpasswd'
 
 apache_basic_auth_modules:
@@ -91,3 +103,52 @@ apache_letsencrypt_proxy_modules:
 
 apache_letsencrypt_proxy_conf:
   - letsencrypt-proxy.conf
+
+#
+# EL only settings. They come from the httpd role this one absorbs, renamed from
+# httpd_* to apache_*: on EL the whole httpd.conf is templated, while on deb the
+# packaged apache2.conf is left alone and only ports.conf and the modules are
+# managed.
+#
+apache_server_admin: root@localhost
+apache_base_document_root_override: 'None'
+apache_base_document_root_access: 'denied'
+apache_document_root_options: 'Indexes FollowSymLinks'
+apache_document_root_override: 'None'
+apache_document_root_access: 'granted'
+
+apache_cgi_enabled: False
+apache_sendfile_enabled: 'on'
+apache_mmap_enabled: 'on'
+apache_use_canonicalname: 'off'
+# The httpd role this one absorbs used OS. Prod is the safer value, but changing
+# it here would be a silent change for every host that inherits the default.
+apache_servertokens: 'OS'
+apache_hostname_lookups: 'off'
+apache_default_charset: 'UTF-8'
+apache_languages:
+  - en
+  - it
+
+apache_timeout: 60
+apache_keepalive_enabled: True
+apache_keepalive_timeout: 5
+apache_keepalive_requests: 100
+
+# MPM tuning, used by the EL httpd.conf template
+apache_startservers: 8
+apache_maxclients: 300
+apache_min_spare: 25
+apache_max_spare: 75
+apache_max_requests_per_child: 0
+apache_threads_per_child: 25
+apache_serverlimit: 256
+
+# Modules on EL are not managed with a2enmod: the apache2_module Ansible module
+# requires the a2enmod and a2dismod binaries, which the EL httpd package does not
+# ship, so the module list of the old role could never be applied there. What EL
+# actually needs is the MPM selection, written into conf.modules.d/00-mpm.conf,
+# plus an optional file for modules the distribution does not load by default.
+# Every entry is emitted as: LoadModule <identifier> modules/<file>
+apache_el_extra_modules: []
+#  - { identifier: 'jk_module', file: 'mod_jk.so' }