JavaScript pour débuter

Installer et régler Apache : hôtes virtuels, certificats et performance.

Installation
Virtual hosts
SSL/TLS

Installation Apache HTTP Server

Installation complète d'Apache sur Linux (Ubuntu/CentOS) et Windows avec les meilleures pratiques.

📦 Installation sur différents systèmes

🐧 Linux (Ubuntu/Debian)

html

# Mise à jour du système
sudo apt update && sudo apt upgrade -y
# Installation Apache
sudo apt install apache2 -y
# Démarrage et activation
sudo systemctl start apache2
sudo systemctl enable apache2
# Vérification du statut
sudo systemctl status apache2
# Configuration du firewall
sudo ufw allow 'Apache Full'

🪟 Windows

html

# Option 1: XAMPP (Recommandé pour dev)
https://www.apachefriends.org/download.html
# Option 2: Installation manuelle
https://httpd.apache.org/download.cgi
# Installation comme service Windows
httpd.exe -k install
# Démarrage du service
net start Apache2.4
# Ou via panneau services
services.msc

Script de vérification d'installation :

html

#!/bin/bash
# check_apache.sh - Script de vérification Apache

echo "=== Vérification de l'installation Apache ==="

# 1. Vérifier si Apache est installé
if command -v apache2 >/dev/null 2>&1; then
    echo "✅ Apache est installé"
    apache2 -v
elif command -v httpd >/dev/null 2>&1; then
    echo "✅ Apache (httpd) est installé"
    httpd -v
else
    echo "❌ Apache n'est pas installé"
    exit 1
fi

# 2. Vérifier le statut du service
echo -e "\n=== Statut du service Apache ==="
if systemctl is-active --quiet apache2; then
    echo "✅ Apache2 service is running"
elif systemctl is-active --quiet httpd; then
    echo "✅ HTTPd service is running"
else
    echo "❌ Apache service is not running"
fi

# 3. Vérifier les ports en écoute
echo -e "\n=== Ports en écoute ==="
if netstat -tlnp 2>/dev/null | grep -q ":80 "; then
    echo "✅ Port 80 (HTTP) en écoute"
else
    echo "⚠️ Port 80 non disponible"
fi

if netstat -tlnp 2>/dev/null | grep -q ":443 "; then
    echo "✅ Port 443 (HTTPS) en écoute"
else
    echo "⚠️ Port 443 non disponible"
fi

# 4. Test de connectivité
echo -e "\n=== Test de connectivité ==="
if curl -s http://localhost >/dev/null; then
    echo "✅ Apache répond sur localhost"
else
    echo "❌ Apache ne répond pas sur localhost"
fi

# 5. Emplacements des fichiers importants
echo -e "\n=== Emplacements des fichiers ==="

# Ubuntu/Debian
if [ -d "/etc/apache2" ]; then
    echo "📁 Configuration: /etc/apache2/"
    echo "📁 Sites disponibles: /etc/apache2/sites-available/"
    echo "📁 Sites activés: /etc/apache2/sites-enabled/"
    echo "📁 Modules: /etc/apache2/mods-available/"
    echo "📁 Logs: /var/log/apache2/"
    echo "📁 Document root: /var/www/html/"

# CentOS/RHEL
elif [ -d "/etc/httpd" ]; then
    echo "📁 Configuration: /etc/httpd/"
    echo "📁 Sites: /etc/httpd/conf.d/"
    echo "📁 Modules: /etc/httpd/modules/"
    echo "📁 Logs: /var/log/httpd/"
    echo "📁 Document root: /var/www/html/"
fi

echo -e "\n=== Test terminé ==="

Configuration de Base Apache

Structure des fichiers de configuration et paramètres essentiels pour un serveur Apache fonctionnel.

⚙️ Fichier apache2.conf / httpd.conf principal

html

# Configuration Apache de base - /etc/apache2/apache2.conf (Ubuntu)
# ou /etc/httpd/conf/httpd.conf (CentOS)

# ===== SERVEUR GLOBAL =====

# Nom du serveur (remplacez par votre domaine)
ServerName example.com:80

# Email de l'administrateur
ServerAdmin admin@example.com

# Répertoire racine du serveur
ServerRoot "/etc/apache2"  # Ubuntu
# ServerRoot "/etc/httpd"   # CentOS

# Fichier de processus
PidFile ${APACHE_PID_FILE}

# Timeout des requêtes (30 secondes recommandé)
Timeout 30

# Garder les connexions vivantes
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5

# ===== MODULES =====

# Modules essentiels (Ubuntu utilise LoadModule automatique)
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule headers_module modules/mod_headers.so
LoadModule deflate_module modules/mod_deflate.so

# ===== UTILISATEUR/GROUPE =====

# Ubuntu/Debian
User www-data
Group www-data

# CentOS/RHEL
# User apache
# Group apache

# ===== RÉPERTOIRES =====

# Répertoire principal des sites
DocumentRoot "/var/www/html"

# Permissions par défaut - SÉCURISÉ
<Directory "/">
    Options None
    AllowOverride None
    Require all denied
</Directory>

# Répertoire web - permissions spécifiques
<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted

    # Sécurité: masquer les fichiers sensibles
    <FilesMatch "\.(htaccess|htpasswd|ini|log|sh)$">
        Require all denied
    </FilesMatch>
</Directory>

# ===== LOGS =====

# Niveau de log (debug, info, notice, warn, error, crit, alert, emerg)
LogLevel warn

# Format des logs personnalisé
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

# Logs d'erreur globaux
ErrorLog ${APACHE_LOG_DIR}/error.log

# Logs d'accès globaux
CustomLog ${APACHE_LOG_DIR}/access.log combined

# ===== SÉCURITÉ =====

# Masquer la version Apache
ServerTokens Prod
ServerSignature Off

# Headers de sécurité
Header always set X-Content-Type-Options nosniff
Header always set X-Frame-Options DENY
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set Content-Security-Policy "default-src 'self'"

# Limiter la taille des requêtes (10MB)
LimitRequestBody 10485760

# Masquer les extensions dans URLs
<FilesMatch "\.(php|html)$">
    Header set Cache-Control "no-cache, no-store, must-revalidate"
</FilesMatch>

# ===== PERFORMANCE =====

# Compression GZIP
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

# Cache statique
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/gif "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/pdf "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType application/x-shockwave-flash "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 year"
</IfModule>

# ===== VIRTUAL HOSTS =====

# Inclusion des sites (Ubuntu)
Include /etc/apache2/sites-enabled/*.conf

# CentOS
# Include conf.d/*.conf

# ===== MODULES ADDITIONNELS =====

# Ubuntu: inclusion automatique
Include /etc/apache2/mods-enabled/*.load
Include /etc/apache2/mods-enabled/*.conf

# Port d'écoute
Listen 80
Listen 443 ssl

🔒 Configuration Ports et Sécurité

html

# ports.conf - Configuration des ports d'écoute

# Port HTTP standard
Listen 80

# Port HTTPS (SSL/TLS)
<IfModule mod_ssl.c>
    Listen 443 ssl
</IfModule>

# Port alternatif pour dev/test
Listen 8080

# Écoute sur IP spécifique uniquement
# Listen 192.168.1.100:80
# Listen [::]:80  # IPv6

# ===== SÉCURITÉ AVANCÉE =====

# Fichier security.conf

# 1. Masquer les informations serveur
ServerTokens Prod
ServerSignature Off

# 2. Désactiver l'accès aux répertoires système
<DirectoryMatch "^\.|\/\.">
    Require all denied
</DirectoryMatch>

# 3. Protection contre les attaques
<IfModule mod_security.c>
    SecRuleEngine On
    SecRequestBodyAccess On
    SecResponseBodyAccess Off

    # Limites de requête
    SecRequestBodyLimit 13107200
    SecRequestBodyNoFilesLimit 131072

    # Filtres basiques
    SecRule ARGS "@detectSQLi" "id:1001,phase:2,block,msg:'SQL Injection Attack Detected'"
    SecRule ARGS "@detectXSS" "id:1002,phase:2,block,msg:'XSS Attack Detected'"
</IfModule>

# 4. Limitation du taux de requêtes
<IfModule mod_evasive24.c>
    DOSHashTableSize 4096
    DOSPageCount 3
    DOSPageInterval 1
    DOSSiteCount 50
    DOSSiteInterval 1
    DOSBlockingPeriod 10
</IfModule>

# 5. Headers de sécurité HTTP
<IfModule mod_headers.c>
    # Prévention XSS
    Header always set X-XSS-Protection "1; mode=block"

    # Prévention clickjacking
    Header always set X-Frame-Options SAMEORIGIN

    # Prévention MIME sniffing
    Header always set X-Content-Type-Options nosniff

    # Politique de sécurité du contenu (CSP)
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https:; connect-src 'self'; media-src 'self'; object-src 'none'; child-src 'self'; form-action 'self'; upgrade-insecure-requests"

    # HSTS (HTTP Strict Transport Security)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # Référent Policy
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Permissions Policy
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

    # Supprimer headers révélateurs
    Header unset Server
    Header unset X-Powered-By
</IfModule>

# 6. Protection des fichiers sensibles
<Files ".htaccess">
    Require all denied
</Files>

<Files ".htpasswd">
    Require all denied
</Files>

<FilesMatch "\.(env|log|ini)$">
    Require all denied
</FilesMatch>

# 7. Désactivation de l'énumération des répertoires
Options -Indexes

# 8. Protection contre les attaques par force brute
<IfModule mod_fail2ban.c>
    Fail2BanEnable On
    Fail2BanMaxRetry 3
    Fail2BanFindTime 600
    Fail2BanBanTime 3600
</IfModule>

# 9. Limitation des méthodes HTTP
<LimitExcept GET POST HEAD>
    Require all denied
</LimitExcept>

# 10. Timeout de sécurité
Timeout 30
KeepAliveTimeout 2

# ===== FIREWALL SYSTÈME =====

# Commands pour UFW (Ubuntu)
# sudo ufw allow 80/tcp
# sudo ufw allow 443/tcp
# sudo ufw enable

# Commands pour firewalld (CentOS)
# sudo firewall-cmd --permanent --add-service=http
# sudo firewall-cmd --permanent --add-service=https
# sudo firewall-cmd --reload

Configuration des Virtual Hosts

Héberger plusieurs sites sur un seul serveur Apache avec des configurations personnalisées.

🌐 Configuration Virtual Host complet

Virtual Host HTTP (port 80)

html

# /etc/apache2/sites-available/example.com.conf

<VirtualHost *:80>
    # Domaine principal
    ServerName example.com
    ServerAlias www.example.com

    # Email administrateur
    ServerAdmin admin@example.com

    # Répertoire du site
    DocumentRoot /var/www/example.com/public_html

    # Logs spécifiques au site
    ErrorLog ${APACHE_LOG_DIR}/example.com_error.log
    CustomLog ${APACHE_LOG_DIR}/example.com_access.log combined

    # Répertoire et permissions
    <Directory /var/www/example.com/public_html>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted

        # PHP settings (si nécessaire)
        php_admin_value upload_max_filesize 64M
        php_admin_value post_max_size 64M
        php_admin_value memory_limit 256M
        php_admin_value max_execution_time 300
    </Directory>

    # Redirection HTTPS (optionnel)
    # Redirect permanent / https://example.com/
</VirtualHost>

Virtual Host HTTPS (port 443)

html

# HTTPS Virtual Host avec SSL

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin admin@example.com

    DocumentRoot /var/www/example.com/public_html

    # Configuration SSL
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/example.com.key
    SSLCertificateChainFile /etc/ssl/certs/ca-certificates.crt

    # Sécurité SSL moderne
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE+AESGCM:ECDHE+AES256:!aNULL:!MD5
    SSLHonorCipherOrder on

    # Headers HSTS
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

    # Logs SSL
    ErrorLog ${APACHE_LOG_DIR}/example.com_ssl_error.log
    CustomLog ${APACHE_LOG_DIR}/example.com_ssl_access.log combined

    <Directory /var/www/example.com/public_html>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
</IfModule>

Script de création automatique de Virtual Host :

html

#!/bin/bash
# create_vhost.sh - Script de création automatique de Virtual Host

# Configuration
SITE_NAME=""
DOMAIN=""
EMAIL="admin@localhost"
DOCUMENT_ROOT=""
CREATE_SSL=false

# Fonction d'aide
show_help() {
    echo "Usage: $0 -d DOMAIN [-n SITE_NAME] [-e EMAIL] [-r ROOT] [-s]"
    echo ""
    echo "Options:"
    echo "  -d DOMAIN      Nom de domaine (obligatoire)"
    echo "  -n SITE_NAME   Nom du site (défaut: DOMAIN)"
    echo "  -e EMAIL       Email administrateur (défaut: admin@localhost)"
    echo "  -r ROOT        Document root (défaut: /var/www/DOMAIN/public_html)"
    echo "  -s             Créer configuration SSL"
    echo "  -h             Afficher cette aide"
    exit 1
}

# Parser les arguments
while getopts "d:n:e:r:sh" opt; do
    case $opt in
        d) DOMAIN="$OPTARG" ;;
        n) SITE_NAME="$OPTARG" ;;
        e) EMAIL="$OPTARG" ;;
        r) DOCUMENT_ROOT="$OPTARG" ;;
        s) CREATE_SSL=true ;;
        h) show_help ;;
        *) show_help ;;
    esac
done

# Vérifications
if [ -z "$DOMAIN" ]; then
    echo "❌ Erreur: Le domaine est obligatoire"
    show_help
fi

if [ -z "$SITE_NAME" ]; then
    SITE_NAME="$DOMAIN"
fi

if [ -z "$DOCUMENT_ROOT" ]; then
    DOCUMENT_ROOT="/var/www/$DOMAIN/public_html"
fi

echo "🚀 Création du Virtual Host pour $DOMAIN"

# 1. Créer le répertoire du site
echo "📁 Création du répertoire: $DOCUMENT_ROOT"
sudo mkdir -p "$DOCUMENT_ROOT"
sudo chown -R www-data:www-data "/var/www/$DOMAIN"
sudo chmod -R 755 "/var/www/$DOMAIN"

# 2. Créer page d'index par défaut
cat > "$DOCUMENT_ROOT/index.html" << EOF
<!DOCTYPE html>
<html lang="fr">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>$SITE_NAME - Site en construction</title>
    <style>
        body { font-family: Arial, sans-serif; text-align: center; margin-top: 50px; }
        .container { max-width: 600px; margin: 0 auto; padding: 20px; }
        h1 { color: #d22128; }
    </style>
</head>
<body>
    <div class="container">
        <h1>🚀 $SITE_NAME</h1>
        <p>Votre site est maintenant configuré sur Apache!</p>
        <p><strong>Domaine:</strong> $DOMAIN</p>
        <p><strong>Document Root:</strong> $DOCUMENT_ROOT</p>
        <hr>
        <small>Apache Virtual Host créé automatiquement</small>
    </div>
</body>
</html>
EOF

# 3. Créer la configuration HTTP
VHOST_FILE="/etc/apache2/sites-available/$DOMAIN.conf"

echo "⚙️ Création de la configuration: $VHOST_FILE"

cat > "$VHOST_FILE" << EOF
# Configuration Virtual Host pour $DOMAIN
# Créé automatiquement le $(date)

<VirtualHost *:80>
    ServerName $DOMAIN
    ServerAlias www.$DOMAIN
    ServerAdmin $EMAIL

    DocumentRoot $DOCUMENT_ROOT

    # Logs
    ErrorLog \${APACHE_LOG_DIR}/${DOMAIN}_error.log
    CustomLog \${APACHE_LOG_DIR}/${DOMAIN}_access.log combined

    # Configuration répertoire
    <Directory $DOCUMENT_ROOT>
        Options -Indexes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted

        # Sécurité
        <FilesMatch "\.(htaccess|htpasswd|ini|log|sh)$">
            Require all denied
        </FilesMatch>
    </Directory>

    # Compression GZIP
    <IfModule mod_deflate.c>
        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/js application/javascript application/x-javascript
    </IfModule>

    # Cache des fichiers statiques
    <IfModule mod_expires.c>
        ExpiresActive On
        ExpiresByType image/jpg "access plus 1 month"
        ExpiresByType image/jpeg "access plus 1 month"
        ExpiresByType image/gif "access plus 1 month"
        ExpiresByType image/png "access plus 1 month"
        ExpiresByType text/css "access plus 1 month"
        ExpiresByType application/pdf "access plus 1 month"
        ExpiresByType application/javascript "access plus 1 month"
        ExpiresByType image/x-icon "access plus 1 year"
    </IfModule>

    # Redirection vers HTTPS (décommentez si SSL configuré)
    # Redirect permanent / https://$DOMAIN/
</VirtualHost>
EOF

# 4. Créer configuration HTTPS si demandé
if [ "$CREATE_SSL" = true ]; then
    echo "🔒 Ajout de la configuration SSL"

    cat >> "$VHOST_FILE" << EOF

# Configuration HTTPS pour $DOMAIN
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName $DOMAIN
    ServerAlias www.$DOMAIN
    ServerAdmin $EMAIL

    DocumentRoot $DOCUMENT_ROOT

    # Configuration SSL
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/${DOMAIN}.crt
    SSLCertificateKeyFile /etc/ssl/private/${DOMAIN}.key
    # SSLCertificateChainFile /etc/ssl/certs/ca-certificates.crt

    # Sécurité SSL moderne
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305
    SSLHonorCipherOrder off
    SSLSessionTickets off

    # Headers de sécurité
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

    # Logs SSL
    ErrorLog \${APACHE_LOG_DIR}/${DOMAIN}_ssl_error.log
    CustomLog \${APACHE_LOG_DIR}/${DOMAIN}_ssl_access.log combined

    <Directory $DOCUMENT_ROOT>
        Options -Indexes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
</IfModule>
EOF
fi

# 5. Activer le site
echo "✅ Activation du site"
sudo a2ensite "$DOMAIN.conf"

# 6. Vérifier la configuration
echo "🔍 Vérification de la configuration"
if sudo apache2ctl configtest; then
    echo "✅ Configuration valide"

    # 7. Recharger Apache
    echo "🔄 Rechargement d'Apache"
    sudo systemctl reload apache2

    echo ""
    echo "🎉 Virtual Host créé avec succès!"
    echo "📍 Domaine: $DOMAIN"
    echo "📁 Répertoire: $DOCUMENT_ROOT"
    echo "⚙️ Configuration: $VHOST_FILE"
    echo ""
    echo "📝 Actions à faire:"
    echo "1. Ajouter $DOMAIN dans /etc/hosts (pour test local):"
    echo "   127.0.0.1 $DOMAIN www.$DOMAIN"
    echo "2. Configurer votre DNS pour pointer vers ce serveur"
    if [ "$CREATE_SSL" = true ]; then
        echo "3. Installer les certificats SSL dans:"
        echo "   - Certificat: /etc/ssl/certs/${DOMAIN}.crt"
        echo "   - Clé privée: /etc/ssl/private/${DOMAIN}.key"
    fi

else
    echo "❌ Erreur dans la configuration Apache"
    echo "Vérifiez le fichier: $VHOST_FILE"
    exit 1
fi

💡 Commandes utiles pour Virtual Hosts

# Gestion des sites (Ubuntu)

sudo a2ensite example.com.conf

sudo a2dissite example.com.conf

sudo systemctl reload apache2

# Test de configuration

sudo apache2ctl configtest

sudo apache2ctl -S # Liste des vhosts

# Gestion des modules

sudo a2enmod rewrite

sudo a2enmod ssl

sudo a2dismod autoindex

# Debug

tail -f /var/log/apache2/error.log

apache2 -V # Version et compilation

Configuration SSL/TLS

Sécuriser vos sites avec SSL/TLS. Let's Encrypt, certificats auto-signés et configuration optimale.

🔐 SSL avec Let's Encrypt (Certbot)

html

#!/bin/bash
# setup_ssl.sh - Configuration SSL automatique avec Let's Encrypt

# Variables
DOMAIN=""
EMAIL=""
WEBROOT="/var/www/html"

# Fonction d'aide
show_help() {
    echo "Usage: $0 -d DOMAIN -e EMAIL [-w WEBROOT]"
    echo ""
    echo "Options:"
    echo "  -d DOMAIN    Nom de domaine"
    echo "  -e EMAIL     Email pour Let's Encrypt"
    echo "  -w WEBROOT   Répertoire web (défaut: /var/www/html)"
    exit 1
}

# Parser les arguments
while getopts "d:e:w:h" opt; do
    case $opt in
        d) DOMAIN="$OPTARG" ;;
        e) EMAIL="$OPTARG" ;;
        w) WEBROOT="$OPTARG" ;;
        h) show_help ;;
        *) show_help ;;
    esac
done

# Vérifications
if [ -z "$DOMAIN" ] || [ -z "$EMAIL" ]; then
    echo "❌ Domaine et email obligatoires"
    show_help
fi

echo "🔒 Configuration SSL pour $DOMAIN"

# 1. Installation Certbot
echo "📦 Installation de Certbot"

# Ubuntu/Debian
if command -v apt >/dev/null 2>&1; then
    sudo apt update
    sudo apt install -y certbot python3-certbot-apache

# CentOS/RHEL
elif command -v yum >/dev/null 2>&1; then
    sudo yum install -y epel-release
    sudo yum install -y certbot python3-certbot-apache

# Fedora
elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y certbot python3-certbot-apache
fi

# 2. Obtenir le certificat SSL
echo "🔐 Obtention du certificat SSL"

# Méthode 1: Automatique avec plugin Apache
sudo certbot --apache \
    -d "$DOMAIN" \
    -d "www.$DOMAIN" \
    --email "$EMAIL" \
    --agree-tos \
    --non-interactive \
    --redirect

# Méthode 2: Webroot (si problème avec --apache)
# sudo certbot certonly --webroot \
#     -w "$WEBROOT" \
#     -d "$DOMAIN" \
#     -d "www.$DOMAIN" \
#     --email "$EMAIL" \
#     --agree-tos \
#     --non-interactive

# 3. Configuration SSL optimale manuelle (si nécessaire)
SSL_CONF="/etc/apache2/sites-available/${DOMAIN}-ssl.conf"

if [ ! -f "$SSL_CONF" ]; then
    echo "⚙️ Création de la configuration SSL optimale"

    cat > "$SSL_CONF" << 'EOF'
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName DOMAIN_PLACEHOLDER
    ServerAlias www.DOMAIN_PLACEHOLDER

    DocumentRoot WEBROOT_PLACEHOLDER

    # Configuration SSL Let's Encrypt
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/privkey.pem

    # Configuration SSL moderne et sécurisée
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder off
    SSLSessionTickets off

    # Configuration OCSP Stapling
    SSLUseStapling on
    SSLStaplingResponderTimeout 5
    SSLStaplingReturnResponderErrors off
    SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

    # Headers de sécurité SSL
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set X-Frame-Options DENY
    Header always set X-Content-Type-Options nosniff
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # CSP (Content Security Policy) - À adapter selon vos besoins
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https:; connect-src 'self'; media-src 'self'; object-src 'none'; child-src 'self'; form-action 'self'; upgrade-insecure-requests"

    # Logs SSL
    ErrorLog ${APACHE_LOG_DIR}/DOMAIN_PLACEHOLDER_ssl_error.log
    CustomLog ${APACHE_LOG_DIR}/DOMAIN_PLACEHOLDER_ssl_access.log combined

    <Directory WEBROOT_PLACEHOLDER>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
</IfModule>
EOF

    # Remplacer les placeholders
    sed -i "s/DOMAIN_PLACEHOLDER/$DOMAIN/g" "$SSL_CONF"
    sed -i "s|WEBROOT_PLACEHOLDER|$WEBROOT|g" "$SSL_CONF"

    # Activer le site SSL
    sudo a2ensite "${DOMAIN}-ssl.conf"
fi

# 4. Activer les modules SSL nécessaires
echo "🔧 Activation des modules SSL"
sudo a2enmod ssl
sudo a2enmod headers
sudo a2enmod rewrite

# 5. Configuration SSL globale optimale
SSL_CONF_FILE="/etc/apache2/conf-available/ssl-params.conf"

cat > "$SSL_CONF_FILE" << 'EOF'
# Configuration SSL globale moderne

# Désactiver la compression SSL (CRIME attack)
SSLCompression off

# Configuration OCSP Stapling globale
SSLStaplingCache "shmcb:logs/stapling(32768)"

# Session Cache
SSLSessionCache "shmcb:logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300

# Configuration par défaut pour tous les vhosts SSL
SSLOptions +StrictRequire

# Désactiver les protocoles non sécurisés
SSLProtocol -all +TLSv1.2 +TLSv1.3

# Chiffrement moderne
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

# Désactiver l'ordre de préférence du client
SSLHonorCipherOrder off

# Désactiver la renégociation SSL
SSLInsecureRenegotiation off

# Activer OCSP Stapling
SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off

# Configuration des courbes elliptiques
SSLOpenSSLConfCmd Curves X25519:secp256r1:secp384r1

# Logs SSL détaillés (à désactiver en production)
# LogLevel ssl:info
EOF

sudo a2enconf ssl-params

# 6. Redirection HTTP vers HTTPS automatique
HTTP_CONF="/etc/apache2/sites-available/${DOMAIN}.conf"

if [ -f "$HTTP_CONF" ]; then
    echo "🔄 Configuration de la redirection HTTP vers HTTPS"

    # Backup de la config existante
    sudo cp "$HTTP_CONF" "${HTTP_CONF}.backup"

    # Ajouter redirection si pas déjà présente
    if ! grep -q "Redirect permanent" "$HTTP_CONF"; then
        sudo sed -i '/<\/VirtualHost>/i \    # Redirection vers HTTPS\n    Redirect permanent / https://'"$DOMAIN"'/' "$HTTP_CONF"
    fi
fi

# 7. Test de la configuration
echo "🔍 Test de la configuration"
if sudo apache2ctl configtest; then
    echo "✅ Configuration valide"

    # Recharger Apache
    sudo systemctl reload apache2

    echo ""
    echo "🎉 SSL configuré avec succès!"
    echo "🔒 Certificat: /etc/letsencrypt/live/$DOMAIN/"
    echo ""

    # 8. Configuration du renouvellement automatique
    echo "⏰ Configuration du renouvellement automatique"

    # Tester le renouvellement
    sudo certbot renew --dry-run

    # Ajouter tâche cron si pas déjà présente
    CRON_CMD="0 0,12 * * * root sleep $(($RANDOM \% 3600)) && certbot renew --quiet"

    if ! sudo crontab -l 2>/dev/null | grep -q "certbot renew"; then
        echo "$CRON_CMD" | sudo tee -a /etc/crontab
        echo "✅ Renouvellement automatique configuré"
    fi

    echo ""
    echo "📋 Informations SSL:"
    echo "🌐 Site: https://$DOMAIN"
    echo "📅 Expiration: $(sudo certbot certificates | grep -A 1 "$DOMAIN" | grep "Expiry Date" | cut -d' ' -f5-)"
    echo ""
    echo "🔍 Test SSL en ligne:"
    echo "https://www.ssllabs.com/ssltest/analyze.html?d=$DOMAIN"

else
    echo "❌ Erreur dans la configuration SSL"
    echo "Vérifiez les logs: sudo tail /var/log/apache2/error.log"
    exit 1
fi

# 9. Fonctions utiles
echo ""
echo "📝 Commandes utiles SSL:"
echo "# Vérifier les certificats:"
echo "sudo certbot certificates"
echo ""
echo "# Renouveler manuellement:"
echo "sudo certbot renew"
echo ""
echo "# Test de configuration SSL:"
echo "openssl s_client -connect $DOMAIN:443 -servername $DOMAIN"
echo ""
echo "# Vérifier la configuration SSL d'Apache:"
echo "sudo apache2ctl -D DUMP_MODULES | grep ssl"

Performance et Optimisation

Optimisez les performances d'Apache : cache, compression, tuning et monitoring.

⚡ Configuration Performance Apache

html

# Configuration Performance Apache
# Fichier: /etc/apache2/conf-available/performance.conf

# ===== MPM (Multi-Processing Module) =====

# Pour sites à fort trafic - MPM Event (recommandé)
<IfModule mod_mpm_event.c>
    # Nombre de processus serveur à démarrer
    StartServers             3

    # Nombre minimum/maximum de processus inactifs
    MinSpareThreads          75
    MaxSpareThreads          250

    # Limite de threads par processus enfant
    ThreadsPerChild          25

    # Limite maximale de processus enfants
    MaxRequestWorkers        400

    # Limite de requêtes par processus enfant avant redémarrage
    MaxRequestsPerChild      10000

    # Configuration async
    AsyncRequestWorkerFactor 2
</IfModule>

# Pour sites moyens - MPM Prefork (compatible avec mod_php)
<IfModule mod_mpm_prefork.c>
    StartServers           8
    MinSpareServers        5
    MaxSpareServers        20
    MaxRequestWorkers      150
    MaxRequestsPerChild    10000
</IfModule>

# Pour sites légers - MPM Worker
<IfModule mod_mpm_worker.c>
    StartServers           3
    MinSpareThreads        75
    MaxSpareThreads        250
    ThreadsPerChild        25
    MaxRequestWorkers      400
    MaxRequestsPerChild    10000
</IfModule>

# ===== COMPRESSION GZIP/DEFLATE =====

<IfModule mod_deflate.c>
    # Activer la compression pour les types MIME
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE application/ld+json
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE application/font-woff
    AddOutputFilterByType DEFLATE application/font-woff2

    # Exclure les fichiers déjà compressés
    SetEnvIfNoCase Request_URI \
        \.(?:gif|jpe?g|png|zip|gz|bz2|rar|7z)$ no-gzip dont-vary
    SetEnvIfNoCase Request_URI \
        \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary

    # Niveau de compression (1-9, 6 = bon compromis)
    DeflateCompressionLevel 6

    # Headers pour les proxies
    Header append Vary Accept-Encoding
</IfModule>

# ===== CACHE ET EXPIRES =====

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"

    # HTML
    ExpiresByType text/html "access plus 0 seconds"

    # CSS et JS
    ExpiresByType text/css "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType application/x-javascript "access plus 1 year"
    ExpiresByType text/javascript "access plus 1 year"

    # Images
    ExpiresByType image/gif "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/jpg "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 year"

    # Polices
    ExpiresByType application/font-woff "access plus 1 year"
    ExpiresByType application/font-woff2 "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"

    # Documents
    ExpiresByType application/pdf "access plus 1 month"

    # Données
    ExpiresByType application/json "access plus 0 seconds"
    ExpiresByType application/xml "access plus 0 seconds"
    ExpiresByType text/xml "access plus 0 seconds"
</IfModule>

# Cache Control Headers
<IfModule mod_headers.c>
    # Cache pour fichiers statiques
    <FilesMatch "\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>

    # Pas de cache pour HTML/PHP
    <FilesMatch "\.(html|htm|php)$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires 0
    </FilesMatch>

    # ETag pour validation cache
    FileETag MTime Size
</IfModule>

# ===== OPTIMISATION RÉSEAU =====

# Désactiver les lookups DNS (améliore performance)
HostnameLookups Off

# Timeout optimisé
Timeout 30
KeepAlive On
KeepAliveTimeout 5
MaxKeepAliveRequests 100

# Taille des buffers
LimitRequestLine 8190
LimitRequestFields 100
LimitRequestFieldSize 8190
LimitRequestBody 10485760

# ===== SÉCURITÉ ET PERFORMANCE =====

# Masquer la signature du serveur
ServerTokens Prod
ServerSignature Off

# Désactiver l'énumération des répertoires
Options -Indexes

# Désactiver .htaccess lookup pour les fichiers statiques
<LocationMatch "\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2)$">
    AllowOverride None
</LocationMatch>

# ===== OPTIMISATION SYSTÈME =====

# Utilisation de sendfile pour les fichiers statiques
EnableSendfile On

# MMAP pour les fichiers
EnableMMAP On

# ===== MODULE MOD_PAGESPEED (optionnel) =====

# Configuration PageSpeed (si installé)
<IfModule mod_pagespeed.c>
    ModPagespeed on
    ModPagespeedFileCachePath "/var/cache/mod_pagespeed/"

    # Optimisations automatiques
    ModPagespeedEnableFilters rewrite_css,rewrite_javascript
    ModPagespeedEnableFilters rewrite_images
    ModPagespeedEnableFilters convert_jpeg_to_progressive,convert_png_to_jpeg,convert_jpeg_to_webp,convert_to_webp_lossless
    ModPagespeedEnableFilters collapse_whitespace,remove_comments
    ModPagespeedEnableFilters combine_css,combine_javascript
    ModPagespeedEnableFilters extend_cache
    ModPagespeedEnableFilters lazyload_images

    # Configuration cache
    ModPagespeedMemcachedServers "localhost:11211"
</IfModule>

# ===== MONITORING ET LOGS =====

# Status du serveur (à protéger)
<IfModule mod_status.c>
    <Location "/server-status">
        SetHandler server-status
        Require local
        # Require ip 192.168.1
    </Location>

    <Location "/server-info">
        SetHandler server-info
        Require local
    </Location>

    # Status étendu
    ExtendedStatus On
</IfModule>

# Rotation des logs pour performance
<IfModule mod_log_rotate.c>
    RotateLogs On
    RotateLogsLocalTime On
    RotateInterval 86400
</IfModule>

# ===== OPTIMISATION PHP (si mod_php utilisé) =====

<IfModule mod_php.c>
    # Optimisations PHP
    php_value memory_limit 128M
    php_value max_execution_time 30
    php_value max_input_time 60
    php_value post_max_size 32M
    php_value upload_max_filesize 32M
    php_value max_file_uploads 20

    # Cache OPcache
    php_value opcache.enable 1
    php_value opcache.memory_consumption 128
    php_value opcache.max_accelerated_files 10000
    php_value opcache.revalidate_freq 2
    php_value opcache.fast_shutdown 1
</IfModule>

# ===== SCRIPT DE BENCHMARK =====

# Test de charge simple avec Apache Bench
# ab -n 1000 -c 10 http://votre-site.com/

# Test avancé avec options
# ab -n 10000 -c 100 -k -H "Accept-Encoding: gzip,deflate" http://votre-site.com/

📊 Monitoring et Tuning Apache

html

#!/bin/bash
# apache_monitoring.sh - Script de monitoring Apache complet

# Configuration
APACHE_STATUS_URL="http://localhost/server-status?auto"
LOG_FILE="/var/log/apache_monitor.log"
ALERT_EMAIL="admin@example.com"
THRESHOLD_CPU=80
THRESHOLD_MEMORY=80
THRESHOLD_CONNECTIONS=200

# Couleurs pour l'affichage
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Fonction de log
log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Fonction d'alerte
send_alert() {
    local message="$1"
    echo "$message" | mail -s "Alerte Apache - $(hostname)" "$ALERT_EMAIL"
    log_message "ALERT: $message"
}

echo "===== MONITORING APACHE ====="
echo "Date: $(date)"
echo "Serveur: $(hostname)"
echo ""

# 1. STATUT DU SERVICE APACHE
echo "🔍 1. Statut du service Apache"
if systemctl is-active --quiet apache2; then
    echo -e "${GREEN}✅ Apache est actif${NC}"
    UPTIME=$(systemctl show apache2 --property=ActiveEnterTimestamp | cut -d= -f2)
    echo "   Démarré depuis: $UPTIME"
else
    echo -e "${RED}❌ Apache est inactif${NC}"
    send_alert "Apache service is down on $(hostname)"
    exit 1
fi

# 2. UTILISATION DES RESSOURCES
echo ""
echo "📊 2. Utilisation des ressources"

# CPU
CPU_USAGE=$(ps aux | grep '[a]pache2\|[h]ttpd' | awk '{cpu+=$3} END {print cpu}')
CPU_USAGE=${CPU_USAGE:-0}
echo "CPU Apache: ${CPU_USAGE}%"
if (( $(echo "$CPU_USAGE > $THRESHOLD_CPU" | bc -l) )); then
    echo -e "${RED}⚠️ CPU élevé: ${CPU_USAGE}%${NC}"
    send_alert "High CPU usage: ${CPU_USAGE}% on $(hostname)"
fi

# Mémoire
MEMORY_INFO=$(ps aux | grep '[a]pache2\|[h]ttpd' | awk '{mem+=$4; rss+=$6} END {printf "%.1f %d", mem, rss}')
MEMORY_PERCENT=$(echo $MEMORY_INFO | cut -d' ' -f1)
MEMORY_RSS=$(echo $MEMORY_INFO | cut -d' ' -f2)
echo "Mémoire Apache: ${MEMORY_PERCENT}% (${MEMORY_RSS} KB)"

if (( $(echo "$MEMORY_PERCENT > $THRESHOLD_MEMORY" | bc -l) )); then
    echo -e "${RED}⚠️ Mémoire élevée: ${MEMORY_PERCENT}%${NC}"
fi

# Processus Apache
APACHE_PROCESSES=$(ps aux | grep '[a]pache2\|[h]ttpd' | wc -l)
echo "Processus Apache actifs: $APACHE_PROCESSES"

# 3. CONNEXIONS ET TRAFFIC
echo ""
echo "🌐 3. Connexions et trafic"

# Connexions actives
ACTIVE_CONNECTIONS=$(netstat -an | grep ':80\|:443' | grep ESTABLISHED | wc -l)
echo "Connexions actives: $ACTIVE_CONNECTIONS"

if [ "$ACTIVE_CONNECTIONS" -gt "$THRESHOLD_CONNECTIONS" ]; then
    echo -e "${YELLOW}⚠️ Nombreuses connexions: $ACTIVE_CONNECTIONS${NC}"
fi

# Status Apache (si mod_status activé)
if curl -s "$APACHE_STATUS_URL" > /dev/null 2>&1; then
    echo ""
    echo "📈 Status Apache détaillé:"

    STATUS_DATA=$(curl -s "$APACHE_STATUS_URL")

    TOTAL_ACCESSES=$(echo "$STATUS_DATA" | grep "Total Accesses:" | cut -d: -f2)
    TOTAL_KBYTES=$(echo "$STATUS_DATA" | grep "Total kBytes:" | cut -d: -f2)
    UPTIME=$(echo "$STATUS_DATA" | grep "Uptime:" | cut -d: -f2)
    REQ_PER_SEC=$(echo "$STATUS_DATA" | grep "ReqPerSec:" | cut -d: -f2)
    BYTES_PER_SEC=$(echo "$STATUS_DATA" | grep "BytesPerSec:" | cut -d: -f2)
    BYTES_PER_REQ=$(echo "$STATUS_DATA" | grep "BytesPerReq:" | cut -d: -f2)
    BUSY_WORKERS=$(echo "$STATUS_DATA" | grep "BusyWorkers:" | cut -d: -f2)
    IDLE_WORKERS=$(echo "$STATUS_DATA" | grep "IdleWorkers:" | cut -d: -f2)

    echo "  Total requêtes:$TOTAL_ACCESSES"
    echo "  Total KB transférés:$TOTAL_KBYTES"
    echo "  Uptime:$UPTIME secondes"
    echo "  Requêtes/sec:$REQ_PER_SEC"
    echo "  Bytes/sec:$BYTES_PER_SEC"
    echo "  Bytes/requête:$BYTES_PER_REQ"
    echo "  Workers occupés:$BUSY_WORKERS"
    echo "  Workers inactifs:$IDLE_WORKERS"
fi

# 4. ANALYSE DES LOGS
echo ""
echo "📋 4. Analyse des logs récents"

# Log d'erreurs - dernières 10 lignes
if [ -f "/var/log/apache2/error.log" ]; then
    echo "Dernières erreurs:"
    tail -n 5 /var/log/apache2/error.log | while read line; do
        echo "  $line"
    done
fi

# Top des codes d'erreur dans les dernières 1000 lignes
if [ -f "/var/log/apache2/access.log" ]; then
    echo ""
    echo "Top codes de réponse (1000 dernières requêtes):"
    tail -n 1000 /var/log/apache2/access.log | awk '{print $9}' | sort | uniq -c | sort -nr | head -5 | while read count code; do
        case $code in
            200) status="OK" ;;
            404) status="Not Found" ;;
            500) status="Internal Error" ;;
            403) status="Forbidden" ;;
            *) status="Other" ;;
        esac
        echo "  $count × $code ($status)"
    done

    echo ""
    echo "Top IPs (1000 dernières requêtes):"
    tail -n 1000 /var/log/apache2/access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head -5 | while read count ip; do
        echo "  $count × $ip"
    done
fi

# 5. CONFIGURATION ET RECOMMANDATIONS
echo ""
echo "⚙️ 5. Configuration actuelle"

# MPM utilisé
MPM_MODULE=$(apache2ctl -M | grep mpm | awk '{print $1}')
echo "Module MPM actif: $MPM_MODULE"

# Modules critiques
echo "Modules de performance:"
apache2ctl -M | grep -E "(deflate|expires|headers|rewrite|ssl)" | while read module; do
    echo "  ✅ $module"
done

# Test de configuration
CONFIG_TEST=$(apache2ctl configtest 2>&1)
if echo "$CONFIG_TEST" | grep -q "Syntax OK"; then
    echo -e "${GREEN}✅ Configuration Apache valide${NC}"
else
    echo -e "${RED}❌ Erreur de configuration:${NC}"
    echo "$CONFIG_TEST"
fi

# 6. RECOMMANDATIONS PERFORMANCE
echo ""
echo "💡 6. Recommandations"

# Vérifier la compression
if ! apache2ctl -M | grep -q deflate; then
    echo -e "${YELLOW}⚠️ Module deflate non activé - activer avec: a2enmod deflate${NC}"
fi

# Vérifier le cache
if ! apache2ctl -M | grep -q expires; then
    echo -e "${YELLOW}⚠️ Module expires non activé - activer avec: a2enmod expires${NC}"
fi

# Vérifier SSL
if ! apache2ctl -M | grep -q ssl; then
    echo -e "${YELLOW}⚠️ Module SSL non activé - activer avec: a2enmod ssl${NC}"
fi

# 7. NETTOYAGE ET MAINTENANCE
echo ""
echo "🧹 7. Maintenance"

# Taille des logs
LOG_SIZE=$(du -sh /var/log/apache2/ 2>/dev/null | cut -f1)
echo "Taille des logs Apache: ${LOG_SIZE:-N/A}"

# Rotation des logs si trop volumineux
if [ -f "/var/log/apache2/access.log" ]; then
    ACCESS_LOG_SIZE=$(stat -c%s "/var/log/apache2/access.log" 2>/dev/null)
    if [ "$ACCESS_LOG_SIZE" -gt 104857600 ]; then  # 100MB
        echo -e "${YELLOW}⚠️ Log d'accès volumineux (>100MB) - considérer la rotation${NC}"
    fi
fi

# 8. RÉSUMÉ ET SCORE
echo ""
echo "🎯 8. Résumé"

SCORE=100
ISSUES=0

if (( $(echo "$CPU_USAGE > $THRESHOLD_CPU" | bc -l) )); then
    ((SCORE-=20))
    ((ISSUES++))
fi

if (( $(echo "$MEMORY_PERCENT > $THRESHOLD_MEMORY" | bc -l) )); then
    ((SCORE-=15))
    ((ISSUES++))
fi

if [ "$ACTIVE_CONNECTIONS" -gt "$THRESHOLD_CONNECTIONS" ]; then
    ((SCORE-=10))
    ((ISSUES++))
fi

if ! apache2ctl -M | grep -q deflate; then
    ((SCORE-=5))
    ((ISSUES++))
fi

echo "Score de santé: $SCORE/100"
if [ "$ISSUES" -eq 0 ]; then
    echo -e "${GREEN}✅ Aucun problème détecté${NC}"
elif [ "$ISSUES" -le 2 ]; then
    echo -e "${YELLOW}⚠️ $ISSUES problème(s) mineur(s)${NC}"
else
    echo -e "${RED}❌ $ISSUES problème(s) détecté(s)${NC}"
fi

# Log du monitoring
log_message "Monitoring terminé - Score: $SCORE/100 - Issues: $ISSUES"

echo ""
echo "===== FIN DU MONITORING ====="

# 9. COMMANDES UTILES
echo ""
echo "🔧 Commandes utiles pour le debugging:"
echo "# Voir les processus Apache:"
echo "ps aux | grep apache2"
echo ""
echo "# Voir les connexions actives:"
echo "netstat -tulpn | grep :80"
echo ""
echo "# Test de charge simple:"
echo "ab -n 100 -c 10 http://localhost/"
echo ""
echo "# Redémarrage gracieux:"
echo "sudo systemctl reload apache2"

Apache HTTP Server Maîtrisé !

Vous maîtrisez maintenant la configuration complète d'Apache : installation, Virtual Hosts, SSL, sécurité et optimisation des performances sur Linux et Windows.

🎯 Compétences acquises :

Installation Apache • Configuration Virtual Hosts • Sécurité SSL/TLS • Optimisation Performance • Monitoring • Logs • Modules • Linux & Windows

Apache HTTP Server maîtrisé

Installation, hôtes virtuels, TLS et réglages : votre serveur web est à vous.