From 572398fe572b0e2a27f1d90353e113a6f6e84382 Mon Sep 17 00:00:00 2001
From: Basil Bruhn <basil.bruhn@psi.ch>
Date: Tue, 11 Nov 2025 12:21:04 +0100
Subject: [PATCH] add apache php / cgi container for future apps and rfmwtools

Signed-off-by: Basil Bruhn <basil.bruhn@psi.ch>
---
 apache/conf/httpd.conf     | 25 ++++++++++++++++++++++++
 conf.d/rfmwtools-test.conf | 39 --------------------------------------
 conf.d/rfmwtools.conf      | 21 ++++++++++++++++++++
 docker-compose.yaml        | 15 +++++++++++++--
 4 files changed, 59 insertions(+), 41 deletions(-)
 create mode 100644 apache/conf/httpd.conf
 delete mode 100644 conf.d/rfmwtools-test.conf
 create mode 100644 conf.d/rfmwtools.conf

diff --git a/apache/conf/httpd.conf b/apache/conf/httpd.conf
new file mode 100644
index 0000000..f4edc99
--- /dev/null
+++ b/apache/conf/httpd.conf
@@ -0,0 +1,25 @@
+# Enable modules
+LoadModule cgi_module modules/mod_cgi.so
+LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule php_module modules/libphp.so  # already in php:8.2-apache
+
+# RFMTools
+DocumentRoot "/var/www/rfmwtools"
+
+<Directory "/var/www/rfmwtools">
+    Options +ExecCGI +FollowSymLinks
+    AddHandler cgi-script .sh .cgi
+    Require all granted
+</Directory>
+
+# Optional: PHP apps under /phpapps (not enabled yet)
+<Directory "/var/www/phpapps">
+    Options Indexes FollowSymLinks
+    AllowOverride All
+    Require all granted
+</Directory>
+
+# Aliases for PHP apps (commented until ready)
+#Alias /phpapp1/ /var/www/phpapps/app1/
+#Alias /phpapp2/ /var/www/phpapps/app2/
+
diff --git a/conf.d/rfmwtools-test.conf b/conf.d/rfmwtools-test.conf
deleted file mode 100644
index d1a9f70..0000000
--- a/conf.d/rfmwtools-test.conf
+++ /dev/null
@@ -1,39 +0,0 @@
-# Gaspar Marcos - ISPD Migration
-server {
-    listen 80;
-    server_name rfmwtools-test.psi.ch;
-
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    server_name rfmwtools-test.psi.ch;
-
-    root /opt/webcontent/rfmwtools;
-    index rfmwtools.html;
-
-    ssl_certificate     /etc/nginx/certs/rfmwtools-test.psi.ch.crt;
-    ssl_certificate_key /etc/nginx/private/rfmwtools-test.psi.ch.key;
-
-    access_log /var/log/nginx/rfmwtools-test.access.log;
-    error_log  /var/log/nginx/rfmwtools-test.error.log;
-
-    # CSP-only framing
-    add_header Content-Security-Policy "frame-ancestors https://*.psi.ch" always;
-    add_header X-Frame-Options "" always;
-
-    location ~* \.(js|css|html|gif|png|jpg|ico)$ {
-        autoindex off;
-        try_files $uri =404;
-    }
-
-    location / {
-        autoindex on;
-        autoindex_exact_size off;
-        autoindex_localtime on;
-
-        try_files $uri/ =404;
-    }
-}
-
diff --git a/conf.d/rfmwtools.conf b/conf.d/rfmwtools.conf
new file mode 100644
index 0000000..5331c38
--- /dev/null
+++ b/conf.d/rfmwtools.conf
@@ -0,0 +1,21 @@
+server {
+    listen 80;
+    server_name rfmwtools-test.psi.ch;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name rfmwtools-test.psi.ch;
+
+    ssl_certificate /etc/nginx/certs/rfmwtools-test.psi.ch.crt;
+    ssl_certificate_key /etc/nginx/private/rfmwtools-test.psi.ch.key;
+
+    location / {
+        proxy_pass http://apache_app:80;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
diff --git a/docker-compose.yaml b/docker-compose.yaml
index ce17a33..ee7cd7c 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -19,12 +19,23 @@ services:
       - /etc/nginx/conf.d:/etc/nginx/conf.d:ro
       - /opt/webcontent/sinqstatus-test:/opt/webcontent/sinqstatus-test:ro
       - /opt/webcontent/fluid-eos:/opt/webcontent/fluid-eos:ro
-      - /opt/webcontent/rfmwtools:/opt/webcontent/rfmwtools:ro
       - /opt/webcontent/it-strategy-dashboard/frontend/:/opt/webcontent/it-strategy-dashboard/:ro
     networks:
       - public
       - backend
- 
+
+  apache:
+    image: php:8.2-apache
+    container_name: apache_app
+    restart: always
+    volumes:
+      - /opt/webcontent/rfmwtools:/var/www/rfmwtools:ro
+#      Apache config is prepared to have php apps inside /var/www/phpapps
+#      - ./phpapps:/var/www/phpapps:ro
+      - ./apache/conf/httpd.conf:/usr/local/etc/apache2/httpd.conf:ro
+    networks:
+      - backend
+
   # linux-eng@psi.ch
   # Test app
   excalidraw: