LPIC-2 202-450: Web Services

Web Services covers Apache 2.4 and nginx: virtual hosting, TLS termination, reverse proxying, logging, and safe reloads. Expect configuration repair rather than memorizing every directive.

Core rules

• Apache reads a main file (/etc/apache2/apache2.conf or /etc/httpd/conf/httpd.conf) plus included vhosts. Debian enables sites with a2ensite; RHEL-family uses IncludeOptional conf.d/*.conf.
• Name-based vhosts need Listen 80, <VirtualHost *:80>, ServerName, ServerAlias, and DocumentRoot. Directory access uses <Directory> with Require all granted; the first matching vhost is the default.
• TLS vhosts listen on 443, set SSLEngine on, SSLCertificateFile, SSLCertificateKeyFile, and often SSLCertificateChainFile. Modern Apache uses SSLProtocol and SSLCipherSuite.
• nginx uses server blocks: listen 80; server_name app.example.com; root /var/www/app; location / { try_files $uri $uri/ =404; }. A reverse proxy adds proxy_pass http://127.0.0.1:3000; and forwards Host, X-Real-IP, X-Forwarded-For, and X-Forwarded-Proto.
• Squid controls access with acl and http_access allow/deny; http_port 3128, cache_dir, and visible_hostname are common. Deny rules must come before broad allow rules.
• Validate before reload: apachectl configtest or nginx -t; then systemctl reload apache2 or nginx.

Worked example

Publish app.example.com through nginx to a Node app on 127.0.0.1:3000. Create /etc/nginx/sites-available/app with server_name app.example.com;, location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }, symlink into sites-enabled, run nginx -t, reload. Reasoning: nginx terminates the client connection; the app sees the original Host and client address; without those headers redirects and logs show 127.0.0.1.

Traps

A missing Listen 443 leaves TLS unreachable; a cert/key mismatch or unreadable key stops startup; the first vhost captures unmatched names; nginx location precedence differs from Apache; and SELinux/AppArmor can return 403 even when file modes look correct. Always test config and check error_log.