Create config/apache.conf

config/apache.conf

@@ -0,0 +1,30 @@
+<VirtualHost *:80>
+    ServerName localhost
+
+    # ── Backend API ──────────────────────────────────────────────────────────
+    Alias /api /var/www/api
+    <Directory /var/www/api>
+        Options -Indexes +FollowSymLinks
+        AllowOverride All
+        Require all granted
+    </Directory>
+
+    # ── User websites ─────────────────────────────────────────────────────────
+    # Reads the X-Username header sent by your app to serve the right folder
+    UseCanonicalName Off
+    DocumentRoot /var/www/html
+
+    <Directory /data/sites>
+        Options -Indexes +FollowSymLinks
+        AllowOverride All
+        Require all granted
+    </Directory>
+
+    # ── Logging ───────────────────────────────────────────────────────────────
+    ErrorLog  /data/logs/apache_error.log
+    CustomLog /data/logs/apache_access.log combined
+
+    # ── Security headers ──────────────────────────────────────────────────────
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set X-Frame-Options "SAMEORIGIN"
+</VirtualHost>