configs/shared-vhost-template.tpl

<Directory "/mnt/users/~~user~~/~~domain~~">
    AllowOverride None
    Require all granted
</Directory>

<Directory "/mnt/users/~~user~~/~~domain~~/public_html">
    Options All MultiViews
    AllowOverride All
    Require all granted
</Directory>

<VirtualHost *:80>
    ServerName "~~domain~~"
    ~~alias_block~~
    DocumentRoot "/mnt/users/~~user~~/~~domain~~/public_html"
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =~~domain~~
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerName "~~domain~~"
    ~~alias_block~~
    DocumentRoot "/mnt/users/~~user~~/~~domain~~/public_html"

    SSLCertificateFile /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

    # Proxy PHP requests to FPM with the correct filesystem path.
    # Apache serves static files directly from /mnt/users/ (read-only mount),
    # but PHP-FPM has files at /home/{user}/public_html/ (its own mount).
    # ProxyPassMatch maps .php URLs directly to the FPM container's path.
    ProxyPassMatch "^/(.*\.php(/.*)?)$" "fcgi://~~fpm_host~~:~~fpm_port~~/home/~~user~~/public_html/$1"

    DirectoryIndex index.php index.html index.htm

    ErrorLog "/var/log/httpd/~~domain~~-error.log"
    CustomLog "/var/log/httpd/~~domain~~-access.log" combined
  </VirtualHost>
</IfModule>
Add shared httpd + PHP-FPM-only container architecture Separate Apache and PHP-FPM into distinct container roles to reduce per-customer memory overhead on shared servers. Adds three new images: - Dockerfile.fpm: PHP-FPM only (no Apache), listens on TCP port 9000 - Dockerfile.shared-httpd: Apache only (no PHP), with SSL and proxy_fcgi - Existing Dockerfile unchanged for standalone mode Key changes: - detect-memory.sh: CONTAINER_ROLE env var (combined/fpm_only/httpd_only) controls the memory budget split - create-php-config.sh: FPM_LISTEN env var for TCP port vs Unix socket, added /fpm-ping and /fpm-status health endpoints - New entrypoints for each container role - tune-mpm.sh for hot-adjusting Apache MPM settings - shared-vhost-template.tpl with proxy_fcgi and SSL on port 443 - CI/CD builds all three image types in parallel Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-01 10:08:00 -07:00			`<Directory "/mnt/users/~~user~~/~~domain~~">`
			`AllowOverride None`
			`Require all granted`
			`</Directory>`

			`<Directory "/mnt/users/~~user~~/~~domain~~/public_html">`
			`Options All MultiViews`
			`AllowOverride All`
			`Require all granted`
			`</Directory>`

			`<VirtualHost *:80>`
			`ServerName "~~domain~~"`
			`~~alias_block~~`
			`DocumentRoot "/mnt/users/~~user~~/~~domain~~/public_html"`
			`RewriteEngine on`
			`RewriteCond %{SERVER_NAME} =~~domain~~`
			`RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]`
			`</VirtualHost>`

			`<IfModule mod_ssl.c>`
			`<VirtualHost *:443>`
			`ServerName "~~domain~~"`
			`~~alias_block~~`
			`DocumentRoot "/mnt/users/~~user~~/~~domain~~/public_html"`

			`SSLCertificateFile /etc/pki/tls/certs/localhost.crt`
			`SSLCertificateKeyFile /etc/pki/tls/private/localhost.key`

Switch shared vhost from SetHandler to ProxyPassMatch for PHP-FPM SetHandler + ProxyFCGISetEnvIf doesn't work for path remapping because reqenv('SCRIPT_FILENAME') is empty when the directive evaluates with the SetHandler approach. ProxyPassMatch directly maps .php URLs to the FPM container's filesystem path, bypassing the SCRIPT_FILENAME rewrite issue entirely: ^/(.\.php(/.)?)$ -> fcgi://fpm:9000/home/{user}/public_html/$1 Static assets (CSS, JS, images) bypass the proxy since they don't match \.php and are served directly by Apache from the read-only mount. Tested and confirmed working on live site with WordPress (including pretty URLs via .htaccess mod_rewrite). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-01 12:50:54 -07:00			`# Proxy PHP requests to FPM with the correct filesystem path.`
			`# Apache serves static files directly from /mnt/users/ (read-only mount),`
			`# but PHP-FPM has files at /home/{user}/public_html/ (its own mount).`
			`# ProxyPassMatch maps .php URLs directly to the FPM container's path.`
			`ProxyPassMatch "^/(.\.php(/.)?)$" "fcgi://~~fpm_host~~:~~fpm_port~~/home/~~user~~/public_html/$1"`
Fix PHP-FPM path mismatch in shared httpd vhost template The shared httpd serves files from /mnt/users/{user}/{domain}/public_html but PHP-FPM containers have them at /home/{user}/public_html. When Apache proxied PHP requests via fcgi, SCRIPT_FILENAME pointed to the Apache path which doesn't exist inside the FPM container, causing "File not found". Added ProxyFCGISetEnvIf to rewrite SCRIPT_FILENAME from the shared httpd path to the FPM container path before proxying the request. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-01 12:22:53 -07:00
Add shared httpd + PHP-FPM-only container architecture Separate Apache and PHP-FPM into distinct container roles to reduce per-customer memory overhead on shared servers. Adds three new images: - Dockerfile.fpm: PHP-FPM only (no Apache), listens on TCP port 9000 - Dockerfile.shared-httpd: Apache only (no PHP), with SSL and proxy_fcgi - Existing Dockerfile unchanged for standalone mode Key changes: - detect-memory.sh: CONTAINER_ROLE env var (combined/fpm_only/httpd_only) controls the memory budget split - create-php-config.sh: FPM_LISTEN env var for TCP port vs Unix socket, added /fpm-ping and /fpm-status health endpoints - New entrypoints for each container role - tune-mpm.sh for hot-adjusting Apache MPM settings - shared-vhost-template.tpl with proxy_fcgi and SSL on port 443 - CI/CD builds all three image types in parallel Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-01 10:08:00 -07:00			`DirectoryIndex index.php index.html index.htm`

			`ErrorLog "/var/log/httpd/~~domain~~-error.log"`
			`CustomLog "/var/log/httpd/~~domain~~-access.log" combined`
			`</VirtualHost>`
			`</IfModule>`