---
apache_service_enabled: True
apache_user: '{% if ansible_distribution_file_variety == "Debian" %}www-data{% else %}apache{% endif %}'
apache_pkg_state: present
apache_group: '{{ apache_user }}'
apache_from_ppa: False
apache_ppa_repo: 'ppa:ondrej/apache2'

apache_listen_ports:
  - 80
  - '{{ apache_ssl_port }}'

# Possible choices: event, prefork (the old ones), worker (the threaded version), itm
apache_mpm_mode: worker

apache_packages: "{{ apache_deb_packages if ansible_distribution_file_variety == 'Debian' else apache_el_packages }}"
apache_deb_packages:
  - apache2
  - apache2-utils
  - libapache2-mod-xsendfile
  - unzip
  - zip
apache_el_packages:
  - httpd
  - httpd-tools
# EL only: mod_ssl is a separate package, on deb it is part of apache2
apache_ssl_packages:
  - mod_ssl

apache_service_name: '{% if ansible_distribution_file_variety == "Debian" %}apache2{% else %}httpd{% endif %}'
apache_base_conf_dir: '{% if ansible_distribution_file_variety == "Debian" %}/etc/apache2{% else %}/etc/httpd{% endif %}'
apache_base_document_root: '{% if ansible_distribution_file_variety == "Debian" %}/var/www{% else %}/var/www{% endif %}'
apache_document_root: '{{ apache_base_document_root }}/html'

apache_modules_packages:
  - 'apache2-mpm-{{ apache_mpm_mode }}'

# Only one can be present at the same time. It needs to be listed as the last one
apache_worker_modules:
#  - { name: 'mpm_itm', state: 'absent' }
  - { name: 'mpm_event', state: 'absent' }
  - { name: 'mpm_prefork', state: 'absent' }
  - { name: 'mpm_{{ apache_mpm_mode }}', state: 'present' }

# apache RPAF is needed to obtain the real client addresses when behind a reverse proxy
apache_rpaf_install: False

apache_default_modules:
  - headers
  - rewrite
  - expires
  - xsendfile

apache_ssl_modules_enabled: True
apache_ssl_port: 443
apache_ssl_modules:
  - ssl
  - socache_shmcb
apache_http_proxy_modules_enabled: False
apache_http_proxy_modules:
  - proxy
  - proxy_ajp
  - proxy_http

apache_status_module: True  
apache_status_location: '/server-status'
apache_status_allowed_hosts:
  - 127.0.0.1/8

apache_info_module: True
apache_info_location: '/server-info'
apache_info_allowed_hosts:
  - 127.0.0.1/8

apache_basic_auth: False
apache_basic_auth_single_file: True
apache_basic_auth_dir: '{{ apache_base_conf_dir }}/auth'
apache_basic_auth_file: '{{ apache_basic_auth_dir }}/htpasswd'

apache_basic_auth_modules:
  - auth_basic
  - authn_file
  - authz_user

# Put them in a vault file. auth_file is optional. Not used when apache_basic_auth_single_file is true
# apache_basic_users:
#   - { username:'', password:'', state:'present,absent', auth_file:'path_to_file' }

#
apache_additional_packages_list: []
#   - libapache2-mod-uwsgi
#   - ...
#
# Set this variable to load the modules you need
apache_additional_modules_list: []
#  -
#  -

apache_letsencrypt_managed: True
apache_letsencrypt_proxy_modules:
  - proxy
  - proxy_http

apache_letsencrypt_proxy_conf:
  - letsencrypt-proxy.conf

#
# EL only settings. They come from the httpd role this one absorbs, renamed from
# httpd_* to apache_*: on EL the whole httpd.conf is templated, while on deb the
# packaged apache2.conf is left alone and only ports.conf and the modules are
# managed.
#
apache_server_admin: root@localhost
apache_base_document_root_override: 'None'
apache_base_document_root_access: 'denied'
apache_document_root_options: 'Indexes FollowSymLinks'
apache_document_root_override: 'None'
apache_document_root_access: 'granted'

apache_cgi_enabled: False
apache_sendfile_enabled: 'on'
apache_mmap_enabled: 'on'
apache_use_canonicalname: 'off'
# The httpd role this one absorbs used OS. Prod is the safer value, but changing
# it here would be a silent change for every host that inherits the default.
apache_servertokens: 'OS'
apache_hostname_lookups: 'off'
apache_default_charset: 'UTF-8'
apache_languages:
  - en
  - it

apache_timeout: 60
apache_keepalive_enabled: True
apache_keepalive_timeout: 5
apache_keepalive_requests: 100

# MPM tuning, used by the EL httpd.conf template
apache_startservers: 8
apache_maxclients: 300
apache_min_spare: 25
apache_max_spare: 75
apache_max_requests_per_child: 0
apache_threads_per_child: 25
apache_serverlimit: 256

# Modules on EL are not managed with a2enmod: the apache2_module Ansible module
# requires the a2enmod and a2dismod binaries, which the EL httpd package does not
# ship, so the module list of the old role could never be applied there. What EL
# actually needs is the MPM selection, written into conf.modules.d/00-mpm.conf,
# plus an optional file for modules the distribution does not load by default.
# Every entry is emitted as: LoadModule <identifier> modules/<file>
apache_el_extra_modules: []
#  - { identifier: 'jk_module', file: 'mod_jk.so' }