LXC / 기타 메모

mkdir -p /etc/apache2/conf-available /etc/apache2/conf-enabled

---

cat > /etc/apache2/conf-available/cache-expires.conf <<'EOF'
<IfModule mod_expires.c>
ExpiresActive On

# HTML은 캐시 짧게
ExpiresByType text/html "access plus 0 seconds"

# 버전이 붙은 정적 자원은 길게
ExpiresByType text/css "access plus 1 year"
ExpiresByType text/javascript "access plus 1 year"
ExpiresByType application/javascript "access plus 1 year"
ExpiresByType application/json "access plus 1 year"
ExpiresByType image/svg+xml "access plus 1 year"
ExpiresByType image/webp "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/gif "access plus 1 year"
ExpiresByType image/avif "access plus 1 year"
ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

<IfModule mod_headers.c>
Header set Cache-Control "public, max-age=31536000, immutable" \
"expr=%{REQUEST_URI} =~ m#\.(css|js|mjs|png|jpe?g|gif|webp|svg|ico|woff2)$#"
</IfModule>
EOF

---

# + nginx reverse proxy
"RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 12.34.56.78
# nginx가 여러 대면 줄 추가
# RemoteIPTrustedProxy 12.34.56.78" > /etc/apache2/conf-available/zz-remoteip-nginx.conf

---

cat > /etc/apache2/mods-available/mpm_event.conf <<'EOF'
<IfModule mpm_event_module>
    ServerLimit              6
    ThreadLimit             64

    StartServers             2
    ThreadsPerChild         25
    MaxRequestWorkers       125

    MinSpareThreads         25
    MaxSpareThreads         75

    MaxConnectionsPerChild  5000
</IfModule>
EOF

---

cat > /etc/apache2/conf-available/zz-ssl-hardening.conf <<'EOF'
<IfModule mod_ssl.c>

  # --- 프로토콜: TLS 1.2/1.3만
  SSLProtocol -all +TLSv1.2 +TLSv1.3

  # --- 세션 재개 정책
  SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(1048576)
  SSLSessionCacheTimeout 300

  # TLS 1.3 Session Ticket (정책상 끄고 싶으면 Off)
  SSLSessionTickets Off

  # --- TLS 1.2 암호군(서버 우선)
  SSLHonorCipherOrder On
  SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

  # --- TLS 1.3 암호군(OpenSSL 1.1.1+)
  # 기본값도 충분히 안전하지만, 명시하고 싶으면 아래처럼
  SSLOpenSSLConfCmd Ciphersuites TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384

  # --- 기타 하드닝
  SSLCompression Off

  # --- OCSP Stapling
  SSLUseStapling On
  SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling(262144)
  SSLStaplingResponderTimeout 5
  SSLStaplingReturnResponderErrors Off
  SSLStaplingErrorCacheTimeout 60

  # (선택) HSTS - "이 도메인은 영원히 HTTPS"가 확실할 때만
  #Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

</IfModule>
EOF

---

a2enmod ssl http2 headers rewrite proxy proxy_http proxy_fcgi setenvif remoteip expires socache_shmcb
a2enconf cache-expires zz-remoteip-nginx.conf zz-ssl-hardening
apache2ctl configtest
systemctl reload apache2

---

mv /etc/php/8.4/fpm/pool.d/www.conf /etc/php/8.4/fpm/pool.d/www.conf.default
cat > /etc/php/8.4/fpm/pool.d/www.conf <<'EOF'
[www]
user = www-data
group = www-data

listen = /run/php/php8.4-fpm.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

pm = dynamic
pm.max_children = 30
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 10
pm.max_requests = 500
EOF

php-fpm8.4 -t
systemctl restart php8.4-fpm