config/apache.conf

<VirtualHost *:80>
    ServerName localhost

    # ── Backend API ──────────────────────────────────────────────────────────
    Alias /api /var/www/api
    <Directory /var/www/api>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # ── User websites ─────────────────────────────────────────────────────────
    # Reads the X-Username header sent by your app to serve the right folder
    UseCanonicalName Off
    DocumentRoot /var/www/html

    <Directory /data/sites>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # ── Logging ───────────────────────────────────────────────────────────────
    ErrorLog  /data/logs/apache_error.log
    CustomLog /data/logs/apache_access.log combined

    # ── Security headers ──────────────────────────────────────────────────────
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
</VirtualHost>