[horde] Recommended Apache config

[lst_hoe02 at kwsoft.de]

Zitat von Vilius Šumskas <vilius at lnk.lt>:

>> >> >> Hello,
>> >> >>
>> >> >> stumbeled the hard way across the need for activated .htaccess and
>> >> >> rewrite stuff for Horde/Nag and maybe other parts of Horde. This
>> >> >> really makes me wonder if there is some resource which explains what
>> >> >> are the recommended/needed webserver features are. In the
>> installation
>> >> >> docs i have not found anything about this and it looks like older
>> >> >> versions of Horde/IMP/Nag haven't need it also.
>> >> >> With something around this it is now working but with the below
>> quote
>> >> >> from the Apache documentation i'm not sure if this is the preferred
>> way:
>> >> >>
>> >> >> <Directory "/var/www/horde">
>> >> >>    Options -Indexes -ExecCGI -Includes -MultiViews
>> >> >>    AllowOverride FileInfo Limit
>> >> >>    Order allow,deny
>> >> >>    Allow from all
>> >> >> </Directory>
>> >> >>
>> >> >>
>> >> >> Quota from Apache docus regarding .htaccess:
>> >> >>
>> >> >> You should avoid using .htaccess files completely if you have access
>> >> >> to httpd main server config file. Using .htaccess files slows down
>> >> >> your Apache http server. Any directive that you can include in a
>> >> >> .htaccess file is better set in a Directory block, as it will have the
>> >> >> same effect with better performance.
>> >> >>
>> >> >> So should i try to merge the .htaccess in the main config?
>> >> >>
>> >> >> Is this documented somwhere?
>> >> >
>> >> > The only thing which is not mentioned in INSTALL docs is that you
>> >> > need mod_rewrite module for the Apache.
>> >> >
>> >> > Other settings are really out of scope of the install documentation
>> >> > because there are too many different webserver configurations out
>> >> > there. You cannot prepare to them all. It's up to system
>> >> > administrators to know what they are doing.
>> >>
>> >> If these settings are vital for the working of a application it should
>> >> be included in the documentation, even more if it was not necessary
>> >> before. If have run all webservers with "AllowOverride None" until now
>> >> because i have never needed it. It is common pratice to disable all
>> >> unneeded things, so simply blame the admin is lazy to say at least.
>> >> With the above argumentation one could also delete the test.php script
>> >> and the documentation about enabling PHP.
>> >
>> > IMHO this goes under the same category as "it is recommended to
>> > *not* use root MySQL user but create a separate user and give it
>> > access to Horde database". MySQL is a requirement, but configuring
>> > and properly securing an environment is totally the job of the
>> > administrator. In your case Apache + mod_rewrite is a requirement,
>> > but allowing Apache to use .htaccess files is totally different
>> > story. It has nothing to do with laziness, it's just simple best
>> > practices/know-how every admin should know.
>>
>> No, enabling mod_rewrite is *not* sufficient to run the application,
>> at least in case of Nag. So it *is* different from the "it works but
>> not recommended" case of the MySQL database.
>> It should be documented that:
>> a.) Horde needs mod_rewrite
>> b.) Horde needs the mod_rewrite settings listed in the .htaccess files
>> either by enabling .htaccess files or by merging it in the main.config
>
> In such case you could say:
>
> c) Horde needs PHP to have a writable permission on a temporary directory.
>
> or:
>
> d) Horde needs an Operating System to have a firewall with 80 port open.

Yes, one could even say

e.) electric power

but this does not improve the documentation at all. If it where common  
pratice or strongly recommended by Apache to enable .htaccess files it  
would be argueable. But if a common configuration is not sufficient  
for running the application it should be noted in the documentation. A  
project with the need to read the source to get it running might be  
fun for programmers, but is nearly useless otherwise.


Regards

Andreas