RHEL 9.0.0 Alpha bootstrap

The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/httpd#c8bf9e154099a01a8f30dde2e71cdb5d9fe40842
2020-10-15 12:30:30 +02:00 · 2020-10-15 12:30:30 +02:00 · e35911cb00
commit e35911cb00
parent 324aaadd0e
78 changed files with 12436 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,40 @@
+httpd-2.2.16.tar.gz
+/httpd-2.2.17.tar.bz2
+x86_64
+/httpd-2.2.17
+/*.rpm
+/.build*.log
+/noarch
+/httpd-2.2.19.tar.gz
+/httpd-2.2.20.tar.gz
+/httpd-2.2.21.tar.bz2
+/clog
+/httpd-2.2.22.tar.bz2
+/httpd-2.4.??/
+/httpd-2.4.2.tar.bz2
+/httpd-2.4.3.tar.bz2
+/httpd-2.4.4.tar.bz2
+/httpd-2.4.6.tar.bz2
+/httpd-2.4.7.tar.bz2
+/httpd-2.4.9.tar.bz2
+/httpd-2.4.10.tar.bz2
+/httpd-2.4.12.tar.bz2
+/httpd-2.4.16.tar.bz2
+/httpd-2.4.17.tar.bz2
+/httpd-2.4.18.tar.bz2
+/httpd-2.4.23.tar.bz2
+/httpd-2.4.25.tar.bz2
+/httpd.socket.8
+/httpd.service.8
+/httpd-2.4.26.tar.bz2
+/httpd-2.4.27.tar.bz2
+/httpd-*.tar.bz2
+/httpd*.8
+/results_httpd
+/htcacheclean.service.8
+/httpd.conf.5
+/httpd-2.4.41.tar.bz2.asc
+/apachectl.8
+/httpd-2.4.43.tar.bz2.asc
+/KEYS
+/httpd-2.4.46.tar.bz2.asc
--- a/00-base.conf
+++ b/00-base.conf
@ -0,0 +1,69 @@
+#
+# This file loads most of the modules included with the Apache HTTP
+# Server itself.
+#
+
+LoadModule access_compat_module modules/mod_access_compat.so
+LoadModule actions_module modules/mod_actions.so
+LoadModule alias_module modules/mod_alias.so
+LoadModule allowmethods_module modules/mod_allowmethods.so
+LoadModule auth_basic_module modules/mod_auth_basic.so
+LoadModule auth_digest_module modules/mod_auth_digest.so
+LoadModule authn_anon_module modules/mod_authn_anon.so
+LoadModule authn_core_module modules/mod_authn_core.so
+LoadModule authn_dbd_module modules/mod_authn_dbd.so
+LoadModule authn_dbm_module modules/mod_authn_dbm.so
+LoadModule authn_file_module modules/mod_authn_file.so
+LoadModule authn_socache_module modules/mod_authn_socache.so
+LoadModule authz_core_module modules/mod_authz_core.so
+LoadModule authz_dbd_module modules/mod_authz_dbd.so
+LoadModule authz_dbm_module modules/mod_authz_dbm.so
+LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule authz_owner_module modules/mod_authz_owner.so
+LoadModule authz_user_module modules/mod_authz_user.so
+LoadModule autoindex_module modules/mod_autoindex.so
+LoadModule brotli_module modules/mod_brotli.so
+LoadModule cache_module modules/mod_cache.so
+LoadModule cache_disk_module modules/mod_cache_disk.so
+LoadModule cache_socache_module modules/mod_cache_socache.so
+LoadModule data_module modules/mod_data.so
+LoadModule dbd_module modules/mod_dbd.so
+LoadModule deflate_module modules/mod_deflate.so
+LoadModule dir_module modules/mod_dir.so
+LoadModule dumpio_module modules/mod_dumpio.so
+LoadModule echo_module modules/mod_echo.so
+LoadModule env_module modules/mod_env.so
+LoadModule expires_module modules/mod_expires.so
+LoadModule ext_filter_module modules/mod_ext_filter.so
+LoadModule filter_module modules/mod_filter.so
+LoadModule headers_module modules/mod_headers.so
+LoadModule include_module modules/mod_include.so
+LoadModule info_module modules/mod_info.so
+LoadModule log_config_module modules/mod_log_config.so
+LoadModule logio_module modules/mod_logio.so
+LoadModule macro_module modules/mod_macro.so
+LoadModule mime_magic_module modules/mod_mime_magic.so
+LoadModule mime_module modules/mod_mime.so
+LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule remoteip_module modules/mod_remoteip.so
+LoadModule reqtimeout_module modules/mod_reqtimeout.so
+LoadModule request_module modules/mod_request.so
+LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
+LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
+LoadModule socache_dbm_module modules/mod_socache_dbm.so
+LoadModule socache_memcache_module modules/mod_socache_memcache.so
+LoadModule socache_redis_module modules/mod_socache_redis.so
+LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
+LoadModule status_module modules/mod_status.so
+LoadModule substitute_module modules/mod_substitute.so
+LoadModule suexec_module modules/mod_suexec.so
+LoadModule unique_id_module modules/mod_unique_id.so
+LoadModule unixd_module modules/mod_unixd.so
+LoadModule userdir_module modules/mod_userdir.so
+LoadModule version_module modules/mod_version.so
+LoadModule vhost_alias_module modules/mod_vhost_alias.so
+LoadModule watchdog_module modules/mod_watchdog.so
+
--- a/00-dav.conf
+++ b/00-dav.conf
@ -0,0 +1,3 @@
+LoadModule dav_module modules/mod_dav.so
+LoadModule dav_fs_module modules/mod_dav_fs.so
+LoadModule dav_lock_module modules/mod_dav_lock.so
--- a/00-lua.conf
+++ b/00-lua.conf
@ -0,0 +1 @@
+LoadModule lua_module modules/mod_lua.so
--- a/00-mpm.conf
+++ b/00-mpm.conf
@ -0,0 +1,23 @@
+# Select the MPM module which should be used by uncommenting exactly
+# one of the following LoadModule lines.  See the httpd.conf(5) man
+# page for more information on changing the MPM.
+
+# prefork MPM: Implements a non-threaded, pre-forking web server
+# See: http://httpd.apache.org/docs/2.4/mod/prefork.html
+#
+# NOTE: If enabling prefork, the httpd_graceful_shutdown SELinux
+# boolean should be enabled, to allow graceful stop/shutdown.
+#
+#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
+
+# worker MPM: Multi-Processing Module implementing a hybrid
+# multi-threaded multi-process web server
+# See: http://httpd.apache.org/docs/2.4/mod/worker.html
+#
+#LoadModule mpm_worker_module modules/mod_mpm_worker.so
+
+# event MPM: A variant of the worker MPM with the goal of consuming
+# threads only for connections with active processing
+# See: http://httpd.apache.org/docs/2.4/mod/event.html
+#
+#LoadModule mpm_event_module modules/mod_mpm_event.so
--- a/00-optional.conf
+++ b/00-optional.conf
@ -0,0 +1,18 @@
+#
+# This file lists modules included with the Apache HTTP Server
+# which are not enabled by default.
+# 
+
+#LoadModule asis_module modules/mod_asis.so
+#LoadModule buffer_module modules/mod_buffer.so
+#LoadModule heartbeat_module modules/mod_heartbeat.so
+#LoadModule heartmonitor_module modules/mod_heartmonitor.so
+#LoadModule usertrack_module modules/mod_usertrack.so
+#LoadModule dialup_module modules/mod_dialup.so
+#LoadModule charset_lite_module modules/mod_charset_lite.so
+#LoadModule log_debug_module modules/mod_log_debug.so
+#LoadModule log_forensic_module modules/mod_log_forensic.so
+#LoadModule ratelimit_module modules/mod_ratelimit.so
+#LoadModule reflector_module modules/mod_reflector.so
+#LoadModule sed_module modules/mod_sed.so
+#LoadModule speling_module modules/mod_speling.so
--- a/00-proxy.conf
+++ b/00-proxy.conf
@ -0,0 +1,18 @@
+# This file configures all the proxy modules:
+LoadModule proxy_module modules/mod_proxy.so
+LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
+LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
+LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
+LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
+LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
+LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
+LoadModule proxy_connect_module modules/mod_proxy_connect.so
+LoadModule proxy_express_module modules/mod_proxy_express.so
+LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
+LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
+LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
+LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
+LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
+LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
--- a/00-proxyhtml.conf
+++ b/00-proxyhtml.conf
@ -0,0 +1,3 @@
+# This file configures mod_proxy_html and mod_xml2enc:
+LoadModule xml2enc_module modules/mod_xml2enc.so
+LoadModule proxy_html_module modules/mod_proxy_html.so
--- a/00-ssl.conf
+++ b/00-ssl.conf
@ -0,0 +1 @@
+LoadModule ssl_module modules/mod_ssl.so
--- a/00-systemd.conf
+++ b/00-systemd.conf
@ -0,0 +1,2 @@
+# This file configures systemd module:
+LoadModule systemd_module modules/mod_systemd.so
--- a/01-cgi.conf
+++ b/01-cgi.conf
@ -0,0 +1,11 @@
+# This configuration file loads a CGI module appropriate to the MPM
+# which has been configured in 00-mpm.conf.  mod_cgid should be used
+# with a threaded MPM; mod_cgi with the prefork MPM.
+
+<IfModule !mpm_prefork_module>
+   LoadModule cgid_module modules/mod_cgid.so
+</IfModule>
+<IfModule mpm_prefork_module>
+   LoadModule cgi_module modules/mod_cgi.so
+</IfModule>
+
--- a/01-ldap.conf
+++ b/01-ldap.conf
@ -0,0 +1,3 @@
+# This file configures the LDAP modules:
+LoadModule ldap_module modules/mod_ldap.so
+LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
--- a/01-session.conf
+++ b/01-session.conf
@ -0,0 +1,6 @@
+LoadModule session_module modules/mod_session.so
+LoadModule session_cookie_module modules/mod_session_cookie.so
+LoadModule session_dbd_module modules/mod_session_dbd.so
+LoadModule auth_form_module modules/mod_auth_form.so
+
+#LoadModule session_crypto_module modules/mod_session_crypto.so
--- a/10-listen443.conf
+++ b/10-listen443.conf
@ -0,0 +1,5 @@
+# This file is part of mod_ssl. It enables listening on port 443 when
+# socket activation is used.
+
+[Socket]
+ListenStream=443
--- a/README.confd
+++ b/README.confd
@ -0,0 +1,9 @@
+
+This directory holds configuration files for the Apache HTTP Server;
+any files in this directory which have the ".conf" extension will be
+processed as httpd configuration files.  The directory is used in
+addition to the directory /etc/httpd/conf.modules.d/, which contains
+configuration files necessary to load modules.
+
+Files are processed in sorted order.  See httpd.conf(5) for more
+information.
--- a/README.confmod
+++ b/README.confmod
@ -0,0 +1,10 @@
+
+This directory holds configuration files for the Apache HTTP Server;
+any files in this directory which have the ".conf" extension will be
+processed as httpd configuration files.  This directory contains
+configuration fragments necessary only to load modules.
+Administrators should use the directory "/etc/httpd/conf.d" to modify
+the configuration of httpd, or any modules.
+
+Files are processed in sorted order and should have a two digit
+numeric prefix.  See httpd.conf(5) for more information.
--- a/action-configtest.sh
+++ b/action-configtest.sh
@ -0,0 +1,2 @@
+#!/bin/sh
+exec /usr/sbin/httpd -t
--- a/action-graceful.sh
+++ b/action-graceful.sh
@ -0,0 +1,2 @@
+#!/bin/sh
+exec /sbin/apachectl graceful
--- a/apachectl.sh
+++ b/apachectl.sh
@ -0,0 +1,67 @@
+#!/usr/bin/sh
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [ "x$1" = "x-k" ]; then
+    shift
+fi
+
+ACMD="$1"
+ARGV="$@"
+SVC='httpd.service'
+HTTPD='@HTTPDBIN@'
+
+if [ "x$2" != "x" ] ; then
+    echo Passing arguments to httpd using apachectl is no longer supported.
+    echo You can only start/stop/restart httpd using this script.
+    echo To pass extra arguments to httpd, see the $SVC'(8)'
+    echo man page.
+    exit 1
+fi
+
+case $ACMD in
+start|stop|restart|status)
+    /usr/bin/systemctl --no-pager $ACMD $SVC
+    ERROR=$?
+    ;;
+graceful)
+    if /usr/bin/systemctl -q is-active $SVC; then
+        /usr/bin/systemctl kill --signal=SIGUSR1 --kill-who=main $SVC
+    else
+        /usr/bin/systemctl start $SVC
+    fi
+    ERROR=$?
+    ;;
+graceful-stop)
+    /usr/bin/systemctl kill --signal=SIGWINCH --kill-who=main $SVC
+    ERROR=$?
+    ;;
+configtest|-t)
+    $HTTPD -t
+    ERROR=$?
+    ;;
+-v|-V)
+    $HTTPD $ACMD
+    ERROR=$?
+    ;;
+*)
+    echo apachectl: The \"$ACMD\" option is not supported. 1>&2
+    ERROR=2
+    ;;
+esac
+
+exit $ERROR
+
--- a/apachectl.xml
+++ b/apachectl.xml
@ -0,0 +1,191 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+  "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">[
+
+]>
+<!--
+ Copyright 2020 Red Hat, Inc.
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<refentry>
+  <refentryinfo>
+    <title>apachectl</title>
+    <productname>httpd</productname>
+    <author><contrib>Apache man page</contrib><othername>Apache Software Foundation contributors</othername></author>
+    <author><contrib>Fedora man page</contrib><surname>Dana</surname><firstname>Frank</firstname></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>apachectl</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>apachectl</refname>
+    <refpurpose>Server control interface for httpd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv id='synopsis'>
+    <cmdsynopsis>
+      <command>apachectl</command>
+      <arg choice='opt'><replaceable>command</replaceable> </arg>
+      <sbr/>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+<!-- body begins here -->
+  <refsect1 id='description'>
+    <title>Description</title>
+
+    <para><command>apachectl</command> is a front end to the Apache HyperText
+    Transfer Protocol (HTTP) server. It is designed to help the
+    administrator control the functioning of the Apache
+    <command>httpd</command> daemon.</para>
+
+    <para>The <command>apachectl</command> script takes one-word arguments like
+    <option>start</option>,
+    <option>restart</option>, and
+    <option>stop</option>, and translates them
+    into appropriate signals to <command>httpd</command>.</para>
+
+    <para>The <command>apachectl</command> script returns a 0 exit value on
+    success, and &gt;0 if an error occurs.</para>
+
+    <refsect2 id="compatibility">
+      <title>Compatibility</title>
+
+      <para>The version of <command>apachectl</command> used on this
+      system is a replacement script intended to be mostly (but not
+      completely) compatible with version provided with
+      <emphasis>Apache httpd</emphasis>.  This
+      <command>apachectl</command> mostly acts as a wrapper around
+      <command>systemctl</command> and manipulates the
+      <command>systemd</command> service for <command>httpd</command>.
+      The interface to the <emphasis>Apache</emphasis> version of
+      <command>apachectl</command> is described at <ulink
+      url="https://httpd.apache.org/docs/2.4/programs/apachectl.html"/>.</para>
+
+      <para>The following differences are present in the version of
+      <command>apachectl</command> present on this system:
+
+      <itemizedlist>
+        <listitem><para>Option arguments passed when starting
+        <command>httpd</command> are not allowed.  These should be
+        configured in the systemd service directly (see <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>).</para></listitem>
+
+        <listitem><para>The <command>"fullstatus"</command> option is
+        not available.</para></listitem>
+
+        <listitem><para>The <command>"status"</command> option does
+        not use or rely on the running server's
+        <emphasis>server-status</emphasis> output.</para></listitem>
+      </itemizedlist>
+
+      </para>
+    </refsect2>
+  </refsect1>
+
+  <refsect1 id='options'>
+    <title>Options</title>
+    <variablelist remap='TP'>
+      <varlistentry>
+        <term><option>start</option></term>
+        <listitem>
+          <para>Start the Apache <command>httpd</command> daemon. Gives an error if it
+          is already running. This is equivalent to <command>systemctl start httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>stop</option></term>
+        <listitem>
+          <para>Stops the Apache <command>httpd</command> daemon. This is equivalent to
+          <command>systemctl stop httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>restart</option></term>
+        <listitem>
+          <para>Restarts the Apache <command>httpd</command> daemon. If the daemon is
+          not running, it is started. This is equivalent
+          to <command>systemctl restart httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>status</option></term>
+        <listitem>
+          <para>Displays a brief status report. This is equivalent to <command>systemctl status httpd.service.</command></para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>graceful</option></term>
+        <listitem>
+          <para>Gracefully restarts the Apache <command>httpd</command> daemon. If the
+          daemon is not running, it is started. This differs from a normal
+          restart in that currently open connections are not aborted. A side
+          effect is that old log files will not be closed immediately. This
+          means that if used in a log rotation script, a substantial delay may
+          be necessary to ensure that the old log files are closed before
+          processing them. This is equivalent to
+          <command>systemctl kill --signal=SIGUSR1 --kill-who=main httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>graceful-stop</option></term>
+        <listitem>
+          <para>Gracefully stops the Apache <command>httpd</command> daemon.
+          This differs from a normal stop in that currently open connections are not
+          aborted. A side effect is that old log files will not be closed immediately.
+          This is equivalent to
+          <command>systemctl kill --signal=SIGWINCH --kill-who=main httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>configtest</option></term>
+        <listitem>
+          <para>Run a configuration file syntax test. It parses the configuration
+          files and either reports <literal>Syntax OK</literal>
+          or detailed information about the particular syntax error. This is
+          equivalent to <command>httpd -t</command>.</para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1 id='bugs'>
+    <title>Bugs</title>
+    <para>Please report bugs by filing an issue in Bugzilla via <ulink url='https://bugzilla.redhat.com/'/>.</para>
+  </refsect1>
+
+    <refsect1>
+    <title>See also</title>
+
+    <para>
+    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+
+</refentry>
--- a/config.layout
+++ b/config.layout
@ -0,0 +1,24 @@
+# Layout used in Fedora httpd packaging.
+<Layout Fedora>
+    prefix:        /etc/httpd
+    localstatedir: /var
+    exec_prefix:   /usr
+    bindir:        ${exec_prefix}/bin
+    sbindir:       ${exec_prefix}/sbin
+    libdir:        ${exec_prefix}/lib
+    libexecdir:    ${exec_prefix}/libexec
+    mandir:        ${exec_prefix}/man
+    sysconfdir:    /etc/httpd/conf
+    datadir:       ${exec_prefix}/share/httpd
+    installbuilddir: ${libdir}/httpd/build
+    errordir:      ${datadir}/error
+    iconsdir:      ${datadir}/icons
+    htdocsdir:     ${localstatedir}/www/html
+    manualdir:     ${datadir}/manual
+    cgidir:        ${localstatedir}/www/cgi-bin
+    includedir:    ${exec_prefix}/include/httpd
+    runtimedir:    ${prefix}/run
+    logfiledir:    ${localstatedir}/log/httpd
+    statedir:      ${prefix}/state
+    proxycachedir: ${localstatedir}/cache/httpd/proxy
+</Layout>     
--- a/htcacheclean.service
+++ b/htcacheclean.service
@ -0,0 +1,11 @@
+[Unit]
+Description=Disk Cache Cleaning Daemon for the Apache HTTP Server
+After=httpd.service
+Documentation=man:htcacheclean.service(8)
+
+[Service]
+Type=forking
+User=apache
+PIDFile=/run/httpd/htcacheclean/pid
+EnvironmentFile=/etc/sysconfig/htcacheclean
+ExecStart=/usr/sbin/htcacheclean -P /run/httpd/htcacheclean/pid -d $INTERVAL -p $CACHE_ROOT -l $LIMIT $OPTIONS
--- a/htcacheclean.service.xml
+++ b/htcacheclean.service.xml
@ -0,0 +1,123 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+
+]>
+<!--
+ Copyright 2018 Red Hat, Inc.
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language overning permissions and
+ limitations under the License.
+-->
+<refentry>
+  <refentryinfo>
+    <title>htcacheclean systemd unit</title>
+    <productname>httpd</productname>
+    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>htcacheclean.service</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>htcacheclean.service</refname>
+    <refpurpose>htcacheclean unit file for systemd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para>
+      <filename>/usr/lib/systemd/system/htcacheclean.service</filename>
+    </para>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>This manual page describes the <command>systemd</command>
+    unit file for the <command>htcacheclean</command> daemon.  This
+    unit file provides a service which runs
+    <command>htcacheclean</command> in daemon mode,
+    periodically cleaning the disk cache root to ensure disk space
+    usage is within configured limits.</para>
+
+  </refsect1>
+
+  <refsect1>
+    <title>Options</title>
+
+    <para>The service is configured by configuration file
+    <filename>/etc/sysconfig/htcacheclean</filename>. The following
+    variables are used, following standard <command>systemd</command>
+    <varname>EnvironmentFile=</varname> syntax:</para>
+
+    <variablelist>
+      <varlistentry>
+        <term><varname>INTERVAL=</varname></term>
+
+        <listitem><para>Sets the interval between cache clean runs, in
+        minutes.  By default this is configured as
+        <emphasis>15</emphasis>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>CACHE_ROOT=</varname></term>
+
+        <listitem><para>Sets the directory name used for the cache
+        root.  By default this is configured as
+        <filename>/var/cache/httpd/proxy</filename>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>LIMIT=</varname></term>
+
+        <listitem><para>Sets the total disk cache space limit, in
+        bytes.  Use a <emphasis>K</emphasis> or <emphasis>M</emphasis>
+        suffix to signify kilobytes or megabytes.  By default this is
+        set to <emphasis>100M</emphasis>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>OPTIONS=</varname></term>
+
+        <listitem><para>Any other options to pass to
+        <command>htcacheclean</command>.</para></listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>Files</title>
+
+    <para><filename>/usr/lib/systemd/system/htcacheclean.service</filename>,
+    <filename>/etc/sysconfig/htcacheclean</filename></para>
+  </refsect1>
+
+  <refsect1>
+    <title>See also</title>
+
+    <para>
+    <citerefentry><refentrytitle>htcacheclean</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+
+</refentry>
+
+<!-- LocalWords:  systemd httpd htcacheclean
+-->
--- a/htcacheclean.sysconf
+++ b/htcacheclean.sysconf
@ -0,0 +1,16 @@
+#
+# Configuration options for systemd service, htcacheclean.service.
+# See htcacheclean(8) for more information on available options.
+#
+
+# Interval between cache clean runs, in minutes
+INTERVAL=15
+
+# Default cache root.
+CACHE_ROOT=/var/cache/httpd/proxy
+
+# Cache size limit in bytes (K=Kbytes, M=Mbytes)
+LIMIT=100M
+
+# Any other options...
+OPTIONS=
--- a/httpd-2.4.43-apxs.patch
+++ b/httpd-2.4.43-apxs.patch
@ -0,0 +1,58 @@
+diff --git a/support/apxs.in b/support/apxs.in
+index b2705fa..c331631 100644
+--- a/support/apxs.in
+++ b/support/apxs.in
+@@ -35,7 +35,18 @@ if ($ddi >= 0) {
+ 
+ my %config_vars = ();
+ 
+-my $installbuilddir = "@exp_installbuilddir@";
+# Awful hack to make apxs libdir-agnostic:
+my $pkg_config = "/usr/bin/pkg-config";
+if (! -x "$pkg_config") {
+    error("$pkg_config not found!");
+    exit(1);
+}
+
+my $libdir = `pkg-config --variable=libdir apr-1`;
+chomp $libdir;
+
+my $installbuilddir = $libdir . "/httpd/build";
+
+ get_config_vars($destdir . "$installbuilddir/config_vars.mk",\%config_vars);
+ 
+ # read the configuration variables once
+@@ -285,7 +296,7 @@ if ($opt_g) {
+     $data =~ s|%NAME%|$name|sg;
+     $data =~ s|%TARGET%|$CFG_TARGET|sg;
+     $data =~ s|%PREFIX%|$prefix|sg;
+-    $data =~ s|%INSTALLBUILDDIR%|$installbuilddir|sg;
+    $data =~ s|%LIBDIR%|$libdir|sg;
+ 
+     my ($mkf, $mods, $src) = ($data =~ m|^(.+)-=#=-\n(.+)-=#=-\n(.+)|s);
+ 
+@@ -463,11 +474,11 @@ if ($opt_c) {
+     my $ldflags = "$CFG_LDFLAGS";
+     if ($opt_p == 1) {
+         
+-        my $apr_libs=`$apr_config --cflags --ldflags --link-libtool --libs`;
+        my $apr_libs=`$apr_config --cflags --ldflags --link-libtool`;
+         chomp($apr_libs);
+         my $apu_libs="";
+         if ($apr_major_version < 2) {
+-            $apu_libs=`$apu_config --ldflags --link-libtool --libs`;
+            $apu_libs=`$apu_config --ldflags --link-libtool`;
+             chomp($apu_libs);
+         }
+         
+@@ -682,8 +693,8 @@ __DATA__
+ 
+ builddir=.
+ top_srcdir=%PREFIX%
+-top_builddir=%PREFIX%
+-include %INSTALLBUILDDIR%/special.mk
+top_builddir=%LIBDIR%/httpd
+include %LIBDIR%/httpd/build/special.mk
+ 
+ #   the used tools
+ APACHECTL=apachectl
--- a/httpd-2.4.43-cachehardmax.patch
+++ b/httpd-2.4.43-cachehardmax.patch
@ -0,0 +1,82 @@
+diff --git a/modules/cache/cache_util.h b/modules/cache/cache_util.h
+index 6b92151..4c42a8e 100644
+--- a/modules/cache/cache_util.h
+++ b/modules/cache/cache_util.h
+@@ -195,6 +195,9 @@ typedef struct {
+     unsigned int store_nostore_set:1;
+     unsigned int enable_set:1;
+     unsigned int disable_set:1;
+    /* treat maxex as hard limit */
+    unsigned int hardmaxex:1;
+    unsigned int hardmaxex_set:1;
+ } cache_dir_conf;
+ 
+ /* A linked-list of authn providers. */
+diff --git a/modules/cache/mod_cache.c b/modules/cache/mod_cache.c
+index 3b9aa4f..8268503 100644
+--- a/modules/cache/mod_cache.c
+++ b/modules/cache/mod_cache.c
+@@ -1455,6 +1455,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in)
+             exp = date + dconf->defex;
+         }
+     }
+    /* else, forcibly cap the expiry date if required */
+    else if (dconf->hardmaxex && (date + dconf->maxex) < exp) {
+        exp = date + dconf->maxex;
+    }        
+
+     info->expire = exp;
+ 
+     /* We found a stale entry which wasn't really stale. */
+@@ -1954,7 +1959,9 @@ static void *create_dir_config(apr_pool_t *p, char *dummy)
+ 
+     /* array of providers for this URL space */
+     dconf->cacheenable = apr_array_make(p, 10, sizeof(struct cache_enable));
+-
+    /* flag; treat maxex as hard limit */
+    dconf->hardmaxex = 0;
+    dconf->hardmaxex_set = 0;
+     return dconf;
+ }
+ 
+@@ -2004,7 +2011,10 @@ static void *merge_dir_config(apr_pool_t *p, void *basev, void *addv) {
+     new->enable_set = add->enable_set || base->enable_set;
+     new->disable = (add->disable_set == 0) ? base->disable : add->disable;
+     new->disable_set = add->disable_set || base->disable_set;
+-
+    new->hardmaxex = 
+        (add->hardmaxex_set == 0)
+        ? base->hardmaxex
+        : add->hardmaxex;
+     return new;
+ }
+ 
+@@ -2332,12 +2342,18 @@ static const char *add_cache_disable(cmd_parms *parms, void *dummy,
+ }
+ 
+ static const char *set_cache_maxex(cmd_parms *parms, void *dummy,
+-                                   const char *arg)
+                                   const char *arg, const char *hard)
+ {
+     cache_dir_conf *dconf = (cache_dir_conf *)dummy;
+ 
+     dconf->maxex = (apr_time_t) (atol(arg) * MSEC_ONE_SEC);
+     dconf->maxex_set = 1;
+    
+    if (hard && strcasecmp(hard, "hard") == 0) {
+        dconf->hardmaxex = 1;
+        dconf->hardmaxex_set = 1;
+    }
+
+     return NULL;
+ }
+ 
+@@ -2545,7 +2561,7 @@ static const command_rec cache_cmds[] =
+                    "caching is enabled"),
+     AP_INIT_TAKE1("CacheDisable", add_cache_disable, NULL, RSRC_CONF|ACCESS_CONF,
+                   "A partial URL prefix below which caching is disabled"),
+-    AP_INIT_TAKE1("CacheMaxExpire", set_cache_maxex, NULL, RSRC_CONF|ACCESS_CONF,
+    AP_INIT_TAKE12("CacheMaxExpire", set_cache_maxex, NULL, RSRC_CONF|ACCESS_CONF,
+                   "The maximum time in seconds to cache a document"),
+     AP_INIT_TAKE1("CacheMinExpire", set_cache_minex, NULL, RSRC_CONF|ACCESS_CONF,
+                   "The minimum time in seconds to cache a document"),
--- a/httpd-2.4.43-corelimit.patch
+++ b/httpd-2.4.43-corelimit.patch
@ -0,0 +1,30 @@
+diff --git a/server/core.c b/server/core.c
+index 79b2a82..dc0f17a 100644
+--- a/server/core.c
+++ b/server/core.c
+@@ -4996,6 +4996,25 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
+     }
+     apr_pool_cleanup_register(pconf, NULL, ap_mpm_end_gen_helper,
+                               apr_pool_cleanup_null);
+
+#ifdef RLIMIT_CORE
+    if (ap_coredumpdir_configured) {
+        struct rlimit lim;
+
+        if (getrlimit(RLIMIT_CORE, &lim) == 0 && lim.rlim_cur == 0) {
+            lim.rlim_cur = lim.rlim_max;
+            if (setrlimit(RLIMIT_CORE, &lim) == 0) {
+                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
+                             "core dump file size limit raised to %lu bytes",
+                             lim.rlim_cur);
+            } else {
+                ap_log_error(APLOG_MARK, APLOG_NOTICE, errno, NULL,
+                             "core dump file size is zero, setrlimit failed");
+            }
+        }
+    }
+#endif
+
+     return OK;
+ }
+ 
--- a/httpd-2.4.43-deplibs.patch
+++ b/httpd-2.4.43-deplibs.patch
@ -0,0 +1,16 @@
+diff --git a/configure.in b/configure.in
+index f8f9442..f276550 100644
+--- a/configure.in
+++ b/configure.in
+@@ -786,9 +786,9 @@ APACHE_SUBST(INSTALL_SUEXEC)
+ 
+ dnl APR should go after the other libs, so the right symbols can be picked up
+ if test x${apu_found} != xobsolete; then
+-  AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool --libs`"
+  AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`"
+ fi
+-AP_LIBS="$AP_LIBS `$apr_config --link-libtool --libs`" 
+AP_LIBS="$AP_LIBS `$apr_config --link-libtool`" 
+ APACHE_SUBST(AP_LIBS)
+ APACHE_SUBST(AP_BUILD_SRCLIB_DIRS)
+ APACHE_SUBST(AP_CLEAN_SRCLIB_DIRS)
--- a/httpd-2.4.43-detect-systemd.patch
+++ b/httpd-2.4.43-detect-systemd.patch
@ -0,0 +1,45 @@
+diff --git a/Makefile.in b/Makefile.in
+index 0b088ac..9eeb5c7 100644
+--- a/Makefile.in
+++ b/Makefile.in
+@@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test
+ 
+ PROGRAM_NAME         = $(progname)
+ PROGRAM_SOURCES      = modules.c
+-PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+ PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
+ PROGRAM_DEPENDENCIES = \
+   server/libmain.la \
+diff --git a/acinclude.m4 b/acinclude.m4
+index 2a7e5d1..eb28321 100644
+--- a/acinclude.m4
+++ b/acinclude.m4
+@@ -624,6 +624,7 @@ case $host in
+       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+         AC_MSG_WARN([Your system does not support systemd.])
+       else
+        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+       fi
+    fi
+diff --git a/configure.in b/configure.in
+index 3618a5a..74a782b 100644
+--- a/configure.in
+++ b/configure.in
+@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then
+   AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
+   APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
+   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
+  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
+ else
+   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
+ fi
+@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR)
+ APACHE_SUBST(BUILTIN_LIBS)
+ APACHE_SUBST(SHLIBPATH_VAR)
+ APACHE_SUBST(OS_SPECIFIC_VARS)
+APACHE_SUBST(HTTPD_LIBS)
+ 
+ PRE_SHARED_CMDS='echo ""'
+ POST_SHARED_CMDS='echo ""'
--- a/httpd-2.4.43-enable-sslv3.patch
+++ b/httpd-2.4.43-enable-sslv3.patch
@ -0,0 +1,62 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 979489c..3d6443b 100644
+--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
+@@ -1485,6 +1485,10 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms,
+ #endif
+         else if (strcEQ(w, "all")) {
+             thisopt = SSL_PROTOCOL_ALL;
+#ifndef OPENSSL_NO_SSL3
+            /* by default, ALL kw doesn't turn on SSLv3 */
+            thisopt &= ~SSL_PROTOCOL_SSLV3;
+#endif
+         }
+         else {
+             return apr_pstrcat(parms->temp_pool,
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index b0fcf81..ab6f263 100644
+--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
+@@ -568,6 +568,28 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
+ }
+ #endif
+ 
+/*
+ * Enable/disable SSLProtocol. If the mod_ssl enables protocol
+ * which is disabled by default by OpenSSL, show a warning.
+ * "option" is for example SSL_OP_NO_SSLv3.
+ */
+static void ssl_set_ctx_protocol_option(server_rec *s,
+                                        SSL_CTX *ctx,
+                                        long option,
+                                        int enabled,
+                                        const char *name)
+{
+      if (!enabled) {
+                SSL_CTX_set_options(ctx, option);
+      }
+      else if (SSL_CTX_get_options(ctx) & option) {
+                    SSL_CTX_clear_options(ctx, option);
+                    ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02904)
+                                 "Allowing SSLProtocol %s even though it is disabled "
+                                 "by OpenSSL by default on this system", name);
+      }
+}
+
+ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+                                           apr_pool_t *p,
+                                           apr_pool_t *ptemp,
+@@ -735,9 +757,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     }
+     if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) {
+         prot = TLS1_VERSION;
+        ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1,
+                                    protocol & SSL_PROTOCOL_TLSV1, "TLSv1");
+     }
+ #ifndef OPENSSL_NO_SSL3
+     if (prot == TLS1_VERSION && protocol & SSL_PROTOCOL_SSLV3) {
+        ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_SSLv3,
+                                    protocol & SSL_PROTOCOL_SSLV3, "SSLv3");
+         prot = SSL3_VERSION;
+     }
+ #endif
--- a/httpd-2.4.43-export.patch
+++ b/httpd-2.4.43-export.patch
@ -0,0 +1,63 @@
+
+Reduce size of httpd binary by telling linker to export all symbols
+from libmain.a, rather than bloating the symbol table with ap_hack_*
+to do so indirectly.
+
+Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
+
+diff --git a/Makefile.in b/Makefile.in
+index 9eeb5c7..8746a10 100644
+--- a/Makefile.in
+++ b/Makefile.in
+@@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test
+ 
+ PROGRAM_NAME         = $(progname)
+ PROGRAM_SOURCES      = modules.c
+-PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) \
+	$(PROGRAM_LDDEPS)  \
+	$(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+ PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
+PROGRAM_LDDEPS = \
+  $(BUILTIN_LIBS) \
+  $(MPM_LIB) \
+  -Wl,--whole-archive,server/.libs/libmain.a,--no-whole-archive \
+  os/$(OS_DIR)/libos.la
+ PROGRAM_DEPENDENCIES = \
+   server/libmain.la \
+   $(BUILTIN_LIBS) \
+diff --git a/server/Makefile.in b/server/Makefile.in
+index 1fa3344..116850b 100644
+--- a/server/Makefile.in
+++ b/server/Makefile.in
+@@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \
+ 	connection.c listen.c util_mutex.c \
+ 	mpm_common.c mpm_unix.c mpm_fdqueue.c \
+ 	util_charset.c util_cookies.c util_debug.c util_xml.c \
+-	util_filter.c util_pcre.c util_regex.c exports.c \
+	util_filter.c util_pcre.c util_regex.c \
+ 	scoreboard.c error_bucket.c protocol.c core.c request.c provider.c \
+ 	eoc_bucket.c eor_bucket.c core_filters.c \
+ 	util_expr_parse.c util_expr_scan.c util_expr_eval.c
+diff --git a/server/main.c b/server/main.c
+index 62e06df..17c09ee 100644
+--- a/server/main.c
+++ b/server/main.c
+@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[])
+     return !OK;
+ }
+ 
+-#ifdef AP_USING_AUTOCONF
+-/* This ugly little hack pulls any function referenced in exports.c into
+- * the web server.  exports.c is generated during the build, and it
+- * has all of the APR functions specified by the apr/apr.exports and
+- * apr-util/aprutil.exports files.
+- */
+-const void *ap_suck_in_APR(void);
+-const void *ap_suck_in_APR(void)
+-{
+-    extern const void *ap_ugly_hack;
+-
+-    return ap_ugly_hack;
+-}
+-#endif
--- a/httpd-2.4.43-gettid.patch
+++ b/httpd-2.4.43-gettid.patch
@ -0,0 +1,93 @@
+From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@redhat.com>
+Date: Tue, 7 Jul 2020 09:48:01 +0100
+Subject: [PATCH] Check and use gettid() directly with glibc 2.30+.
+
+* configure.in: Check for gettid() and define HAVE_SYS_GETTID if
+  gettid() is only usable via syscall().
+
+* server/log.c (log_tid): Use gettid() directly if available.
+---
+ configure.in | 14 +++++++++-----
+ server/log.c |  8 ++++++--
+ 2 files changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index 423d58d4b9a..60cbf7b7f81 100644
+--- httpd-2.4.43/configure.in.gettid
+++ httpd-2.4.43/configure.in
+@@ -478,7 +500,8 @@
+ timegm \
+ getpgid \
+ fopen64 \
+-getloadavg
+getloadavg \
+gettid
+ )
+ 
+ dnl confirm that a void pointer is large enough to store a long integer
+@@ -489,16 +512,19 @@
+    APR_ADDTO(HTTPD_LIBS, [-lselinux])
+ ])
+ 
+-AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
+if test $ac_cv_func_gettid = no; then
+  # On Linux before glibc 2.30, gettid() is only usable via syscall()
+  AC_CACHE_CHECK([for gettid() via syscall], ap_cv_gettid,
+ [AC_TRY_RUN(#define _GNU_SOURCE
+ #include <unistd.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+ int main(int argc, char **argv) {
+ pid_t t = syscall(SYS_gettid); return t == -1 ? 1 : 0; },
+-[ac_cv_gettid=yes], [ac_cv_gettid=no], [ac_cv_gettid=no])])
+-if test "$ac_cv_gettid" = "yes"; then
+-    AC_DEFINE(HAVE_GETTID, 1, [Define if you have gettid()])
+  [ap_cv_gettid=yes], [ap_cv_gettid=no], [ap_cv_gettid=no])])
+  if test "$ap_cv_gettid" = "yes"; then
+      AC_DEFINE(HAVE_SYS_GETTID, 1, [Define if you have gettid() via syscall()])
+  fi
+ fi
+ 
+ dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
+--- httpd-2.4.43/server/log.c.gettid
+++ httpd-2.4.43/server/log.c
+@@ -55,7 +55,7 @@
+ #include "ap_mpm.h"
+ #include "ap_listen.h"
+ 
+-#if HAVE_GETTID
+#if HAVE_SYS_GETTID
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+ #endif
+@@ -625,14 +625,18 @@
+ #if APR_HAS_THREADS
+     int result;
+ #endif
+-#if HAVE_GETTID
+#if defined(HAVE_GETTID) || defined(HAVE_SYS_GETTID)
+     if (arg && *arg == 'g') {
+#ifdef HAVE_GETTID
+        pid_t tid = gettid();
+#else
+         pid_t tid = syscall(SYS_gettid);
+#endif
+         if (tid == -1)
+             return 0;
+         return apr_snprintf(buf, buflen, "%"APR_PID_T_FMT, tid);
+     }
+-#endif
+#endif /* HAVE_GETTID || HAVE_SYS_GETTID */
+ #if APR_HAS_THREADS
+     if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
+         && result != AP_MPMQ_NOT_SUPPORTED)
+@@ -966,7 +970,7 @@
+ #if APR_HAS_THREADS
+         field_start = len;
+         len += cpystrn(buf + len, ":tid ", buflen - len);
+-        item_len = log_tid(info, NULL, buf + len, buflen - len);
+        item_len = log_tid(info, "g", buf + len, buflen - len);
+         if (!item_len)
+             len = field_start;
+         else
--- a/httpd-2.4.43-icons.patch
+++ b/httpd-2.4.43-icons.patch
@ -0,0 +1,22 @@
+diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in
+index 51b02ed..0e8b626 100644
+--- a/docs/conf/extra/httpd-autoindex.conf.in
+++ b/docs/conf/extra/httpd-autoindex.conf.in
+@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort
+ Alias /icons/ "@exp_iconsdir@/"
+ 
+ <Directory "@exp_iconsdir@">
+-    Options Indexes MultiViews
+    Options Indexes MultiViews FollowSymlinks
+     AllowOverride None
+     Require all granted
+ </Directory>
+@@ -53,7 +53,7 @@ AddIcon /icons/dvi.gif .dvi
+ AddIcon /icons/uuencoded.gif .uu
+ AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+ AddIcon /icons/tex.gif .tex
+-AddIcon /icons/bomb.gif core
+AddIcon /icons/bomb.gif core.
+ 
+ AddIcon /icons/back.gif ..
+ AddIcon /icons/hand.right.gif README
--- a/httpd-2.4.43-mod_systemd.patch
+++ b/httpd-2.4.43-mod_systemd.patch
@ -0,0 +1,96 @@
+
+More verbose startup logging for mod_systemd.
+
+--- httpd-2.4.43/modules/arch/unix/mod_systemd.c.mod_systemd
+++ httpd-2.4.43/modules/arch/unix/mod_systemd.c
+@@ -29,11 +29,14 @@
+ #include "mpm_common.h"
+ 
+ #include "systemd/sd-daemon.h"
+#include "systemd/sd-journal.h"
+ 
+ #if APR_HAVE_UNISTD_H
+ #include <unistd.h>
+ #endif
+ 
+static char describe_listeners[30];
+
+ static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+                               apr_pool_t *ptemp)
+ {
+@@ -44,6 +47,20 @@
+     return OK;
+ }
+ 
+static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
+{
+    apr_sockaddr_t *sa = lr->bind_addr;
+    char addr[128];
+
+    if (apr_sockaddr_is_wildcard(sa)) {
+        return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL);
+    }
+
+    apr_sockaddr_ip_getbuf(addr, sizeof addr, sa);
+
+    return apr_psprintf(p, "%s port %u", addr, sa->port);
+}
+
+ /* Report the service is ready in post_config, which could be during
+  * startup or after a reload.  The server could still hit a fatal
+  * startup error after this point during ap_run_mpm(), so this is
+@@ -51,19 +68,51 @@
+  * the TCP ports so new connections will not be rejected.  There will
+  * always be a possible async failure event simultaneous to the
+  * service reporting "ready", so this should be good enough. */
+-static int systemd_post_config(apr_pool_t *p, apr_pool_t *plog,
+static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
+                                apr_pool_t *ptemp, server_rec *main_server)
+ {
+    ap_listen_rec *lr;
+    apr_size_t plen = sizeof describe_listeners;
+    char *p = describe_listeners;
+
+    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
+        return OK;
+
+    for (lr = ap_listeners; lr; lr = lr->next) {
+        char *s = dump_listener(lr, ptemp);
+
+        if (strlen(s) + 3 < plen) {
+            char *newp = apr_cpystrn(p, s, plen);
+            if (lr->next)
+                newp = apr_cpystrn(newp, ", ", 3);
+            plen -= newp - p;
+            p = newp;
+        }
+        else {
+            if (plen < 4) {
+                p = describe_listeners + sizeof describe_listeners - 4;
+                plen = 4;
+            }
+            apr_cpystrn(p, "...", plen);
+            break;
+        }
+    }
+
+     sd_notify(0, "READY=1\n"
+               "STATUS=Configuration loaded.\n");
+
+    sd_journal_print(LOG_INFO, "Server configured, listening on: %s",
+                     describe_listeners);
+
+     return OK;
+ }
+ 
+ static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
+ {
+     sd_notifyf(0, "READY=1\n"
+-               "STATUS=Processing requests...\n"
+-               "MAINPID=%" APR_PID_T_FMT, getpid());
+               "STATUS=Started, listening on: %s\n"
+               "MAINPID=%" APR_PID_T_FMT,
+               describe_listeners, getpid());
+ 
+     return OK;
+ }
--- a/httpd-2.4.43-r1828172+.patch
+++ b/httpd-2.4.43-r1828172+.patch
--- a/httpd-2.4.43-r1842929+.patch
+++ b/httpd-2.4.43-r1842929+.patch
@ -0,0 +1,228 @@
+diff --git a/Makefile.in b/Makefile.in
+index 06b8c5a..9eeb5c7 100644
+--- a/Makefile.in
+++ b/Makefile.in
+@@ -213,6 +213,7 @@ install-cgi:
+ install-other:
+ 	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
+ 	@test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir)
+	@test -d $(DESTDIR)$(statedir) || $(MKINSTALLDIRS) $(DESTDIR)$(statedir)
+ 	@for ext in dll x; do \
+ 		file=apachecore.$$ext; \
+ 		if test -f $$file; then \
+diff --git a/acinclude.m4 b/acinclude.m4
+index 95232f5..5d9d669 100644
+--- a/acinclude.m4
+++ b/acinclude.m4
+@@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[
+   APACHE_SUBST(installbuilddir)
+   APACHE_SUBST(runtimedir)
+   APACHE_SUBST(proxycachedir)
+  APACHE_SUBST(statedir)
+   APACHE_SUBST(other_targets)
+   APACHE_SUBST(progname)
+   APACHE_SUBST(prefix)
+@@ -688,6 +689,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[
+   APACHE_SUBST_EXPANDED_ARG(runtimedir)
+   APACHE_SUBST_EXPANDED_ARG(logfiledir)
+   APACHE_SUBST_EXPANDED_ARG(proxycachedir)
+  APACHE_SUBST_EXPANDED_ARG(statedir)
+ ])
+ 
+ dnl 
+diff --git a/configure.in b/configure.in
+index a63eada..c8f9aa2 100644
+--- a/configure.in
+++ b/configure.in
+@@ -41,7 +41,7 @@ dnl Something seems broken here.
+ AC_PREFIX_DEFAULT(/usr/local/apache2)
+ 
+ dnl Get the layout here, so we can pass the required variables to apr
+-APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir])
+APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir statedir])
+ 
+ dnl reparse the configure arguments.
+ APR_PARSE_ARGUMENTS
+diff --git a/include/ap_config_layout.h.in b/include/ap_config_layout.h.in
+index 2b4a70c..e076f41 100644
+--- a/include/ap_config_layout.h.in
+++ b/include/ap_config_layout.h.in
+@@ -60,5 +60,7 @@
+ #define DEFAULT_REL_LOGFILEDIR "@rel_logfiledir@"
+ #define DEFAULT_EXP_PROXYCACHEDIR "@exp_proxycachedir@"
+ #define DEFAULT_REL_PROXYCACHEDIR "@rel_proxycachedir@"
+#define DEFAULT_EXP_STATEDIR "@exp_statedir@"
+#define DEFAULT_REL_STATEDIR "@rel_statedir@"
+ 
+ #endif /* AP_CONFIG_LAYOUT_H */
+diff --git a/include/http_config.h b/include/http_config.h
+index f9c2d77..c229bc9 100644
+--- a/include/http_config.h
+++ b/include/http_config.h
+@@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname);
+  */
+ AP_DECLARE(char *) ap_runtime_dir_relative(apr_pool_t *p, const char *fname);
+ 
+/**
+ * Compute the name of a persistent state file (e.g. a database or
+ * long-lived cache) relative to the appropriate state directory.
+ * Absolute paths are returned as-is.  The state directory is
+ * configured via the DefaultStateDir directive or at build time.
+ */
+AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *fname);
+
+ /* Finally, the hook for dynamically loading modules in... */
+ 
+ /**
+diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c
+index addfd7e..2389f8f 100644
+--- a/modules/dav/fs/mod_dav_fs.c
+++ b/modules/dav/fs/mod_dav_fs.c
+@@ -29,6 +29,10 @@ typedef struct {
+ 
+ extern module AP_MODULE_DECLARE_DATA dav_fs_module;
+ 
+#ifndef DEFAULT_DAV_LOCKDB
+#define DEFAULT_DAV_LOCKDB "davlockdb"
+#endif
+
+ const char *dav_get_lockdb_path(const request_rec *r)
+ {
+     dav_fs_server_conf *conf;
+@@ -57,6 +61,24 @@ static void *dav_fs_merge_server_config(apr_pool_t *p,
+     return newconf;
+ }
+ 
+static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
+                                       apr_pool_t *ptemp, server_rec *base_server)
+{
+    server_rec *s;
+
+    for (s = base_server; s; s = s->next) {
+        dav_fs_server_conf *conf;
+
+        conf = ap_get_module_config(s->module_config, &dav_fs_module);
+
+        if (!conf->lockdb_path) {
+            conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
+        }
+    }
+
+    return OK;
+}
+
+ /*
+  * Command handler for the DAVLockDB directive, which is TAKE1
+  */
+@@ -87,6 +109,8 @@ static const command_rec dav_fs_cmds[] =
+ 
+ static void register_hooks(apr_pool_t *p)
+ {
+    ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE);
+
+     dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
+                              APR_HOOK_MIDDLE);
+     dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
+diff --git a/server/core.c b/server/core.c
+index 3db9d61..79b2a82 100644
+--- a/server/core.c
+++ b/server/core.c
+@@ -129,6 +129,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP;
+ AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN;
+ AP_DECLARE_DATA int ap_config_generation = 0;
+ 
+static const char *core_state_dir;
+
+ static void *create_core_dir_config(apr_pool_t *a, char *dir)
+ {
+     core_dir_config *conf;
+@@ -1409,12 +1411,15 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word)
+     return res_buf;
+ }
+ 
+-static int reset_config_defines(void *dummy)
+/* pconf cleanup - clear global variables set from config here. */
+static apr_status_t reset_config(void *dummy)
+ {
+     ap_server_config_defines = saved_server_config_defines;
+     saved_server_config_defines = NULL;
+     server_config_defined_vars = NULL;
+-    return OK;
+    core_state_dir = NULL;
+
+    return APR_SUCCESS;
+ }
+ 
+ /*
+@@ -3120,6 +3125,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg)
+     return NULL;
+ }
+ 
+static const char *set_state_dir(cmd_parms *cmd, void *dummy, const char *arg)
+{
+    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
+
+    if (err != NULL) {
+        return err;
+    }
+
+    if ((apr_filepath_merge((char**)&core_state_dir, NULL,
+                            ap_server_root_relative(cmd->temp_pool, arg),
+                            APR_FILEPATH_TRUENAME, cmd->pool) != APR_SUCCESS)
+        || !ap_is_directory(cmd->temp_pool, core_state_dir)) {
+        return "DefaultStateDir must be a valid directory, absolute or relative to ServerRoot";
+    }
+
+    return NULL;
+}
+
+ static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg)
+ {
+     const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT);
+@@ -4414,6 +4437,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ,
+   "Common directory of server-related files (logs, confs, etc.)"),
+ AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ,
+   "Common directory for run-time files (shared memory, locks, etc.)"),
+AP_INIT_TAKE1("DefaultStateDir", set_state_dir, NULL, RSRC_CONF | EXEC_ON_READ,
+  "Common directory for persistent state (databases, long-lived caches, etc.)"),
+ AP_INIT_TAKE1("ErrorLog", set_server_string_slot,
+   (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF,
+   "The filename of the error log"),
+@@ -4941,8 +4966,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem
+ 
+     if (!saved_server_config_defines)
+         init_config_defines(pconf);
+-    apr_pool_cleanup_register(pconf, NULL, reset_config_defines,
+-                              apr_pool_cleanup_null);
+    apr_pool_cleanup_register(pconf, NULL, reset_config, apr_pool_cleanup_null);
+ 
+     ap_regcomp_set_default_cflags(AP_REG_DEFAULT);
+ 
+@@ -5170,6 +5194,27 @@ AP_DECLARE(int) ap_state_query(int query)
+     }
+ }
+ 
+AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *file)
+{
+    char *newpath = NULL;
+    apr_status_t rv;
+    const char *state_dir;
+
+    state_dir = core_state_dir
+        ? core_state_dir
+        : ap_server_root_relative(p, DEFAULT_REL_STATEDIR);
+
+    rv = apr_filepath_merge(&newpath, state_dir, file, APR_FILEPATH_TRUENAME, p);
+    if (newpath && (rv == APR_SUCCESS || APR_STATUS_IS_EPATHWILD(rv)
+                                      || APR_STATUS_IS_ENOENT(rv)
+                                      || APR_STATUS_IS_ENOTDIR(rv))) {
+        return newpath;
+    }
+    else {
+        return NULL;
+    }
+}
+
+ static apr_random_t *rng = NULL;
+ #if APR_HAS_THREADS
+ static apr_thread_mutex_t *rng_mutex = NULL;
--- a/httpd-2.4.43-r1861269.patch
+++ b/httpd-2.4.43-r1861269.patch
@ -0,0 +1,20 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index b53f3f8..979489c 100644
+--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
+@@ -812,8 +812,14 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
+ static const char *ssl_cmd_check_file(cmd_parms *parms,
+                                       const char **file)
+ {
+-    const char *filepath = ap_server_root_relative(parms->pool, *file);
+    const char *filepath;
+ 
+    /* If only dumping the config, don't verify the paths */
+    if (ap_state_query(AP_SQ_RUN_MODE) == AP_SQ_RM_CONFIG_DUMP) {
+        return NULL;
+    }
+
+    filepath = ap_server_root_relative(parms->pool, *file);
+     if (!filepath) {
+         return apr_pstrcat(parms->pool, parms->cmd->name,
+                            ": Invalid file path ", *file, NULL);
--- a/httpd-2.4.43-r1861793+.patch
+++ b/httpd-2.4.43-r1861793+.patch
@ -0,0 +1,271 @@
+diff --git a/configure.in b/configure.in
+index cb43246..0bb6b0d 100644
+--- httpd-2.4.43/configure.in.r1861793+
+++ httpd-2.4.43/configure.in
+@@ -465,6 +465,28 @@
+ AC_SEARCH_LIBS(crypt, crypt)
+ CRYPT_LIBS="$LIBS"
+ APACHE_SUBST(CRYPT_LIBS)
+
+if test "$ac_cv_search_crypt" != "no"; then
+   # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt
+   AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [
+    AC_RUN_IFELSE([AC_LANG_PROGRAM([[
+#include <crypt.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define PASSWD_0 "Hello world!"
+#define SALT_0 "\$6\$saltstring"
+#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \
+               "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1"
+]], [char *result = crypt(PASSWD_0, SALT_0);
+     if (!result) return 1;
+     if (strcmp(result, EXPECT_0)) return 2;
+])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])])
+   if test "$ap_cv_crypt_sha2" = yes; then
+     AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes])
+   fi
+fi
+
+ LIBS="$saved_LIBS"
+ 
+ dnl See Comment #Spoon
+--- httpd-2.4.43/docs/man/htpasswd.1.r1861793+
+++ httpd-2.4.43/docs/man/htpasswd.1
+@@ -27,16 +27,16 @@
+ .SH "SYNOPSIS"
+  
+ .PP
+-\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
+\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
+\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
+\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
+\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
+  
+ 
+ .SH "SUMMARY"
+@@ -48,7 +48,7 @@
+ Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&.
+  
+ .PP
+-\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
+\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
+  
+ .PP
+ This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&.
+@@ -73,17 +73,26 @@
+ \fB-m\fR
+ Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&.  
+ .TP
+\fB-2\fR
+Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
+.TP
+\fB-5\fR
+Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
+.TP
+ \fB-B\fR
+ Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&.  
+ .TP
+ \fB-C\fR
+ This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&.  
+ .TP
+\fB-r\fR
+This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&.  
+.TP
+ \fB-d\fR
+ Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&.  
+ .TP
+ \fB-s\fR
+-Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
+Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
+ .TP
+ \fB-p\fR
+ Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&.  
+@@ -152,10 +161,13 @@
+ When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&.
+  
+ .PP
+-The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
+The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
+ 
+.PP
+The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&.
+  
+ .PP
+-The SHA and \fBcrypt()\fR formats are insecure by today's standards\&.
+The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&.
+  
+ .SH "RESTRICTIONS"
+  
+--- httpd-2.4.43/support/htpasswd.c.r1861793+
+++ httpd-2.4.43/support/htpasswd.c
+@@ -109,17 +109,21 @@
+             "for it." NL
+         " -i  Read password from stdin without verification (for script usage)." NL
+         " -m  Force MD5 encryption of the password (default)." NL
+-        " -B  Force bcrypt encryption of the password (very secure)." NL
+        " -2  Force SHA-256 crypt() hash of the password (very secure)." NL
+        " -5  Force SHA-512 crypt() hash of the password (very secure)." NL
+        " -B  Force bcrypt encryption of the password (very secure)." NL
+         " -C  Set the computing time used for the bcrypt algorithm" NL
+         "     (higher is more secure but slower, default: %d, valid: 4 to 17)." NL
+        " -r  Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL
+        "     (higher is more secure but slower, default: 5000)." NL
+         " -d  Force CRYPT encryption of the password (8 chars max, insecure)." NL
+-        " -s  Force SHA encryption of the password (insecure)." NL
+        " -s  Force SHA-1 encryption of the password (insecure)." NL
+         " -p  Do not encrypt the password (plaintext, insecure)." NL
+         " -D  Delete the specified user." NL
+         " -v  Verify password for the specified user." NL
+         "On other systems than Windows and NetWare the '-p' flag will "
+             "probably not work." NL
+-        "The SHA algorithm does not use a salt and is less secure than the "
+        "The SHA-1 algorithm does not use a salt and is less secure than the "
+             "MD5 algorithm." NL,
+         BCRYPT_DEFAULT_COST
+     );
+@@ -178,7 +182,7 @@
+     if (rv != APR_SUCCESS)
+         exit(ERR_SYNTAX);
+ 
+-    while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) {
+    while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) {
+         switch (opt) {
+         case 'c':
+             *mask |= APHTP_NEWFILE;
+--- httpd-2.4.43/support/passwd_common.c.r1861793+
+++ httpd-2.4.43/support/passwd_common.c
+@@ -179,16 +179,21 @@
+ int mkhash(struct passwd_ctx *ctx)
+ {
+     char *pw;
+-    char salt[16];
+    char salt[17];
+     apr_status_t rv;
+     int ret = 0;
+ #if CRYPT_ALGO_SUPPORTED
+     char *cbuf;
+ #endif
+#ifdef HAVE_CRYPT_SHA2
+    const char *setting;
+    char method;
+#endif
+ 
+-    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) {
+    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT
+        && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) {
+         apr_file_printf(errfile,
+-                        "Warning: Ignoring -C argument for this algorithm." NL);
+                        "Warning: Ignoring -C/-r argument for this algorithm." NL);
+     }
+ 
+     if (ctx->passwd == NULL) {
+@@ -246,6 +251,34 @@
+         break;
+ #endif /* CRYPT_ALGO_SUPPORTED */
+ 
+#ifdef HAVE_CRYPT_SHA2
+    case ALG_CRYPT_SHA256:
+    case ALG_CRYPT_SHA512:
+        ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool);
+        if (ret != 0)
+            break;
+
+        method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6';
+
+        if (ctx->cost) 
+            setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s",
+                                   method, ctx->cost, salt);
+        else
+            setting = apr_psprintf(ctx->pool, "$%c$%s",
+                                   method, salt);
+
+        cbuf = crypt(pw, setting);
+        if (cbuf == NULL) {
+            rv = APR_FROM_OS_ERROR(errno);
+            ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv);
+            ret = ERR_PWMISMATCH;
+            break;
+        }
+
+        apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1);
+        break;
+#endif /* HAVE_CRYPT_SHA2 */
+
+ #if BCRYPT_ALGO_SUPPORTED
+     case ALG_BCRYPT:
+         rv = apr_generate_random_bytes((unsigned char*)salt, 16);
+@@ -294,6 +327,19 @@
+     case 's':
+         ctx->alg = ALG_APSHA;
+         break;
+#ifdef HAVE_CRYPT_SHA2
+    case '2':
+        ctx->alg = ALG_CRYPT_SHA256;
+        break;
+    case '5':
+        ctx->alg = ALG_CRYPT_SHA512;
+        break;
+#else
+    case '2':
+    case '5':
+        ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform.";
+        return ERR_ALG_NOT_SUPP;
+#endif
+     case 'p':
+         ctx->alg = ALG_PLAIN;
+ #if !PLAIN_ALGO_SUPPORTED
+@@ -324,11 +370,12 @@
+         return ERR_ALG_NOT_SUPP;
+ #endif
+         break;
+-    case 'C': {
+    case 'C':
+    case 'r': {
+             char *endptr;
+             long num = strtol(opt_arg, &endptr, 10);
+             if (*endptr != '\0' || num <= 0) {
+-                ctx->errstr = "argument to -C must be a positive integer";
+                ctx->errstr = "argument to -C/-r must be a positive integer";
+                 return ERR_SYNTAX;
+             }
+             ctx->cost = num;
+--- httpd-2.4.43/support/passwd_common.h.r1861793+
+++ httpd-2.4.43/support/passwd_common.h
+@@ -28,6 +28,8 @@
+ #include "apu_version.h"
+ #endif
+ 
+#include "ap_config_auto.h"
+
+ #define MAX_STRING_LEN 256
+ 
+ #define ALG_PLAIN 0
+@@ -35,6 +37,8 @@
+ #define ALG_APMD5 2
+ #define ALG_APSHA 3
+ #define ALG_BCRYPT 4
+#define ALG_CRYPT_SHA256 5
+#define ALG_CRYPT_SHA512 6
+ 
+ #define BCRYPT_DEFAULT_COST 5
+ 
+@@ -84,7 +88,7 @@
+     apr_size_t      out_len;
+     char            *passwd;
+     int             alg;
+-    int             cost;
+    int             cost; /* cost for bcrypt, rounds for SHA-2 */
+     enum {
+         PW_PROMPT = 0,
+         PW_ARG,
--- a/httpd-2.4.43-r1870095+.patch
+++ b/httpd-2.4.43-r1870095+.patch
@ -0,0 +1,115 @@
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index cbab6a3..765aa4b 100644
+--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
+@@ -114,6 +114,45 @@ static int has_buffered_data(request_rec *r)
+     return result;
+ }
+ 
+/* If a renegotiation is required for the location, and the request
+ * includes a message body (and the client has not requested a "100
+ * Continue" response), then the client will be streaming the request
+ * body over the wire already.  In that case, it is not possible to
+ * stop and perform a new SSL handshake immediately; once the SSL
+ * library moves to the "accept" state, it will reject the SSL packets
+ * which the client is sending for the request body.
+ *
+ * To allow authentication to complete in the hook, the solution used
+ * here is to fill a (bounded) buffer with the request body, and then
+ * to reinject that request body later.
+ *
+ * This function is called to fill the renegotiation buffer for the
+ * location as required, or fail.  Returns zero on success or HTTP_
+ * error code on failure.
+ */
+static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)
+{
+    int rv;
+    apr_size_t rsize;
+
+    /* ### this is HTTP/1.1 specific, special case for protocol? */
+    if (r->expecting_100 || !ap_request_has_body(r)) {
+        return 0;
+    }
+
+    rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize;
+    if (rsize > 0) {
+        /* Fill the I/O buffer with the request body if possible. */
+        rv = ssl_io_buffer_fill(r, rsize);
+    }
+    else {
+        /* If the reneg buffer size is set to zero, just fail. */
+        rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
+    }
+
+    return rv;
+}
+
+ #ifdef HAVE_TLSEXT
+ static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)
+ {
+@@ -814,41 +853,14 @@ static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirCo
+         }
+     }
+ 
+-    /* If a renegotiation is now required for this location, and the
+-     * request includes a message body (and the client has not
+-     * requested a "100 Continue" response), then the client will be
+-     * streaming the request body over the wire already.  In that
+-     * case, it is not possible to stop and perform a new SSL
+-     * handshake immediately; once the SSL library moves to the
+-     * "accept" state, it will reject the SSL packets which the client
+-     * is sending for the request body.
+-     *
+-     * To allow authentication to complete in this auth hook, the
+-     * solution used here is to fill a (bounded) buffer with the
+-     * request body, and then to reinject that request body later.
+-     */
+-    if (renegotiate && !renegotiate_quick
+-        && !r->expecting_100
+-        && ap_request_has_body(r)) {
+-        int rv;
+-        apr_size_t rsize;
+-
+-        rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE :
+-                                                dc->nRenegBufferSize;
+-        if (rsize > 0) {
+-            /* Fill the I/O buffer with the request body if possible. */
+-            rv = ssl_io_buffer_fill(r, rsize);
+-        }
+-        else {
+-            /* If the reneg buffer size is set to zero, just fail. */
+-            rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
+-        }
+-
+-        if (rv) {
+    /* Fill reneg buffer if required. */
+    if (renegotiate && !renegotiate_quick) {
+        rc = fill_reneg_buffer(r, dc);
+        if (rc) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257)
+                           "could not buffer message body to allow "
+                           "SSL renegotiation to proceed");
+-            return rv;
+            return rc;
+         }
+     }
+ 
+@@ -1132,6 +1144,17 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon
+             }
+         }
+ 
+        /* Fill reneg buffer if required. */
+        if (change_vmode) {
+            rc = fill_reneg_buffer(r, dc);
+            if (rc) {
+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228)
+                              "could not buffer message body to allow "
+                              "TLS Post-Handshake Authentication to proceed");
+                return rc;
+            }
+        }
+
+         if (change_vmode) {
+             char peekbuf[1];
+ 
--- a/httpd-2.4.43-selinux.patch
+++ b/httpd-2.4.43-selinux.patch
@ -0,0 +1,60 @@
+diff --git a/configure.in b/configure.in
+index c8f9aa2..cb43246 100644
+--- a/configure.in
+++ b/configure.in
+@@ -484,6 +484,11 @@ getloadavg
+ dnl confirm that a void pointer is large enough to store a long integer
+ APACHE_CHECK_VOID_PTR_LEN
+ 
+AC_CHECK_LIB(selinux, is_selinux_enabled, [
+   AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
+   APR_ADDTO(HTTPD_LIBS, [-lselinux])
+])
+
+ AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
+ [AC_TRY_RUN(#define _GNU_SOURCE
+ #include <unistd.h>
+diff --git a/server/core.c b/server/core.c
+index dc0f17a..7ed9527 100644
+--- a/server/core.c
+++ b/server/core.c
+@@ -59,6 +59,10 @@
+ #include <unistd.h>
+ #endif
+ 
+#ifdef HAVE_SELINUX
+#include <selinux/selinux.h>
+#endif
+
+ /* LimitRequestBody handling */
+ #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
+ #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
+@@ -5015,6 +5019,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
+     }
+ #endif
+ 
+#ifdef HAVE_SELINUX
+    {
+        static int already_warned = 0;
+        int is_enabled = is_selinux_enabled() > 0;
+        
+        if (is_enabled && !already_warned) {
+            security_context_t con;
+            
+            if (getcon(&con) == 0) {
+                
+                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
+                             "SELinux policy enabled; "
+                             "httpd running as context %s", con);
+                
+                already_warned = 1;
+                
+                freecon(con);
+            }
+        }
+    }
+#endif
+
+     return OK;
+ }
+ 
--- a/httpd-2.4.43-socket-activation.patch
+++ b/httpd-2.4.43-socket-activation.patch
@ -0,0 +1,300 @@
+diff --git a/server/listen.c b/server/listen.c
+index 5242c2a..e2e028a 100644
+--- a/server/listen.c
+++ b/server/listen.c
+@@ -34,6 +34,10 @@
+ #include <unistd.h>
+ #endif
+ 
+#ifdef HAVE_SYSTEMD
+#include <systemd/sd-daemon.h>
+#endif
+
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -59,9 +63,12 @@ static int ap_listenbacklog;
+ static int ap_listencbratio;
+ static int send_buffer_size;
+ static int receive_buffer_size;
+#ifdef HAVE_SYSTEMD
+static int use_systemd = -1;
+#endif
+ 
+ /* TODO: make_sock is just begging and screaming for APR abstraction */
+-static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_listen)
+ {
+     apr_socket_t *s = server->sd;
+     int one = 1;
+@@ -94,20 +101,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+         return stat;
+     }
+ 
+-#if APR_HAVE_IPV6
+-    if (server->bind_addr->family == APR_INET6) {
+-        stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
+-        if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
+-            ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
+-                          "make_sock: for address %pI, apr_socket_opt_set: "
+-                          "(IPV6_V6ONLY)",
+-                          server->bind_addr);
+-            apr_socket_close(s);
+-            return stat;
+-        }
+-    }
+-#endif
+-
+     /*
+      * To send data over high bandwidth-delay connections at full
+      * speed we must force the TCP window to open wide enough to keep the
+@@ -169,21 +162,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+     }
+ #endif
+ 
+-    if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
+-        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
+-                      "make_sock: could not bind to address %pI",
+-                      server->bind_addr);
+-        apr_socket_close(s);
+-        return stat;
+-    }
+    if (do_bind_listen) {
+#if APR_HAVE_IPV6
+        if (server->bind_addr->family == APR_INET6) {
+            stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
+            if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
+                ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
+                              "make_sock: for address %pI, apr_socket_opt_set: "
+                              "(IPV6_V6ONLY)",
+                              server->bind_addr);
+                apr_socket_close(s);
+                return stat;
+            }
+        }
+#endif
+ 
+-    if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
+-        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
+-                      "make_sock: unable to listen for connections "
+-                      "on address %pI",
+-                      server->bind_addr);
+-        apr_socket_close(s);
+-        return stat;
+        if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
+            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
+                          "make_sock: could not bind to address %pI",
+                          server->bind_addr);
+            apr_socket_close(s);
+            return stat;
+        }
+
+        if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
+            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
+                          "make_sock: unable to listen for connections "
+                          "on address %pI",
+                          server->bind_addr);
+            apr_socket_close(s);
+            return stat;
+        }
+     }
+ 
+ #ifdef WIN32
+@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
+ }
+ 
+#ifdef HAVE_SYSTEMD
+
+static int find_systemd_socket(process_rec * process, apr_port_t port) {
+    int fdcount, fd;
+    int sdc = sd_listen_fds(0);
+
+    if (sdc < 0) {
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
+                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
+                      sdc);
+        return -1;
+    }
+
+    if (sdc == 0) {
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
+                      "find_systemd_socket: At least one socket must be set.");
+        return -1;
+    }
+
+    fdcount = atoi(getenv("LISTEN_FDS"));
+    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
+        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
+            return fd;
+        }
+    }
+
+    return -1;
+}
+
+static apr_status_t alloc_systemd_listener(process_rec * process,
+                                           int fd, const char *proto,
+                                           ap_listen_rec **out_rec)
+{
+    apr_status_t rv;
+    struct sockaddr sa;
+    socklen_t len = sizeof(struct sockaddr);
+    apr_os_sock_info_t si;
+    ap_listen_rec *rec;
+    *out_rec = NULL;
+
+    memset(&si, 0, sizeof(si));
+
+    rv = getsockname(fd, &sa, &len);
+
+    if (rv != 0) {
+        rv = apr_get_netos_error();
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02489)
+                      "getsockname on %d failed.", fd);
+        return rv;
+    }
+
+    si.os_sock = &fd;
+    si.family = sa.sa_family;
+    si.local = &sa;
+    si.type = SOCK_STREAM;
+    si.protocol = APR_PROTO_TCP;
+
+    rec = apr_palloc(process->pool, sizeof(ap_listen_rec));
+    rec->active = 0;
+    rec->next = 0;
+
+
+    rv = apr_os_sock_make(&rec->sd, &si, process->pool);
+    if (rv != APR_SUCCESS) {
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02490)
+                      "apr_os_sock_make on %d failed.", fd);
+        return rv;
+    }
+
+    rv = apr_socket_addr_get(&rec->bind_addr, APR_LOCAL, rec->sd);
+    if (rv != APR_SUCCESS) {
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02491)
+                      "apr_socket_addr_get on %d failed.", fd);
+        return rv;
+    }
+
+    rec->protocol = apr_pstrdup(process->pool, proto);
+
+    *out_rec = rec;
+
+    return make_sock(process->pool, rec, 0);
+}
+
+static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+                                        const char *proto)
+{
+    ap_listen_rec *last, *new;
+    apr_status_t rv;
+    int fd = find_systemd_socket(process, port);
+    if (fd < 0) {
+        return "Systemd socket activation is used, but this port is not "
+                "configured in systemd";
+    }
+
+    last = ap_listeners;
+    while (last && last->next) {
+        last = last->next;
+    }
+
+    rv = alloc_systemd_listener(process, fd, proto, &new);
+    if (rv != APR_SUCCESS) {
+        return "Failed to setup socket passed by systemd using socket activation";
+    }
+
+    if (last == NULL) {
+        ap_listeners = last = new;
+    }
+    else {
+        last->next = new;
+        last = new;
+    }
+
+    return NULL;
+}
+
+#endif /* HAVE_SYSTEMD */
+
+ static const char *alloc_listener(process_rec *process, const char *addr,
+                                   apr_port_t port, const char* proto,
+                                   void *slave)
+@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
+                 }
+             }
+ #endif
+-            if (make_sock(pool, lr) == APR_SUCCESS) {
+            if (make_sock(pool, lr, 1) == APR_SUCCESS) {
+                 ++num_open;
+             }
+             else {
+@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+         }
+     }
+ 
+-    if (open_listeners(s->process->pool)) {
+-        return 0;
+#ifdef HAVE_SYSTEMD
+    if (use_systemd) {
+        const char *userdata_key = "ap_open_systemd_listeners";
+        void *data;
+        /* clear the enviroment on our second run
+        * so that none of our future children get confused.
+        */
+        apr_pool_userdata_get(&data, userdata_key, s->process->pool);
+        if (!data) {
+            apr_pool_userdata_set((const void *)1, userdata_key,
+                                apr_pool_cleanup_null, s->process->pool);
+        }
+        else {
+            sd_listen_fds(1);
+        }
+    }
+    else
+#endif
+    {
+        if (open_listeners(s->process->pool)) {
+            return 0;
+        }
+     }
+ 
+     for (lr = ap_listeners; lr; lr = lr->next) {
+@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+                             duplr->bind_addr);
+                 return stat;
+             }
+-            make_sock(p, duplr);
+            make_sock(p, duplr, 1);
+ #if AP_NONBLOCK_WHEN_MULTI_LISTEN
+             use_nonblock = (ap_listeners && ap_listeners->next);
+             stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
+@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     if (argc < 1 || argc > 2) {
+         return "Listen requires 1 or 2 arguments.";
+     }
+#ifdef HAVE_SYSTEMD
+    if (use_systemd == -1) {
+        use_systemd = sd_listen_fds(0) > 0;
+    }
+#endif
+ 
+     rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
+     if (rv != APR_SUCCESS) {
+@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+         ap_str_tolower(proto);
+     }
+ 
+#ifdef HAVE_SYSTEMD
+    if (use_systemd) {
+        return set_systemd_listener(cmd->server->process, port, proto);
+    }
+#endif
+
+     return alloc_listener(cmd->server->process, host, port, proto, NULL);
+ }
+ 
--- a/httpd-2.4.43-sslciphdefault.patch
+++ b/httpd-2.4.43-sslciphdefault.patch
@ -0,0 +1,31 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 97778a8..27e7a53 100644
+--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
+@@ -778,9 +778,11 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
+     }
+     
+     if (!strcmp("SSL", arg1)) {
+-        /* always disable null and export ciphers */
+-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+         if (cmd->path) {
+            /* Disable null and export ciphers by default, except for PROFILE=
+             * configs where the parser doesn't cope. */
+            if (strncmp(arg2, "PROFILE=", 8) != 0)
+                arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+             dc->szCipherSuite = arg2;
+         }
+         else {
+@@ -1544,8 +1546,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
+     }
+     
+     if (!strcmp("SSL", arg1)) {
+-        /* always disable null and export ciphers */
+-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+        /* Disable null and export ciphers by default, except for PROFILE=
+         * configs where the parser doesn't cope. */
+        if (strncmp(arg2, "PROFILE=", 8) != 0)
+            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+         dc->proxy->auth.cipher_suite = arg2;
+         return NULL;
+     }
--- a/httpd-2.4.43-sslcoalesce.patch
+++ b/httpd-2.4.43-sslcoalesce.patch
@ -0,0 +1,192 @@
+
+http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1836237&r2=1836236&pathrev=1836237&view=patch
+http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1873985&r2=1876037&view=patch
+
+--- httpd-2.4.43/modules/ssl/ssl_engine_io.c.sslcoalesce
+++ httpd-2.4.43/modules/ssl/ssl_engine_io.c
+@@ -1585,18 +1585,32 @@
+ }
+ 
+ 
+-/* ssl_io_filter_output() produces one SSL/TLS message per bucket
+/* ssl_io_filter_output() produces one SSL/TLS record per bucket
+  * passed down the output filter stack.  This results in a high
+- * overhead (network packets) for any output comprising many small
+- * buckets.  SSI page applied through the HTTP chunk filter, for
+- * example, may produce many brigades containing small buckets -
+- * [chunk-size CRLF] [chunk-data] [CRLF].
+ * overhead (more network packets & TLS processing) for any output
+ * comprising many small buckets.  SSI output passed through the HTTP
+ * chunk filter, for example, may produce many brigades containing
+ * small buckets - [chunk-size CRLF] [chunk-data] [CRLF].
+  *
+- * The coalescing filter merges many small buckets into larger buckets
+- * where possible, allowing the SSL I/O output filter to handle them
+- * more efficiently. */
+ * Sending HTTP response headers as a separate TLS record to the
+ * response body also reveals information to a network observer (the
+ * size of headers) which can be significant.
+ *
+ * The coalescing filter merges data buckets with the aim of producing
+ * fewer, larger TLS records - without copying/buffering all content
+ * and introducing unnecessary overhead.
+ *
+ * ### This buffering could be probably be done more comprehensively
+ * ### in ssl_io_filter_output itself. 
+ * 
+ * ### Another possible performance optimisation in particular for the
+ * ### [HEAP] [FILE] HTTP response case is using a brigade rather than
+ * ### a char array to buffer; using apr_brigade_write() to append
+ * ### will use already-allocated memory from the HEAP, reducing # of
+ * ### copies.
+ */
+ 
+-#define COALESCE_BYTES (2048)
+#define COALESCE_BYTES (AP_IOBUFSIZE)
+ 
+ struct coalesce_ctx {
+     char buffer[COALESCE_BYTES];
+@@ -1609,11 +1623,12 @@
+     apr_bucket *e, *upto;
+     apr_size_t bytes = 0;
+     struct coalesce_ctx *ctx = f->ctx;
+    apr_size_t buffered = ctx ? ctx->bytes : 0; /* space used on entry */
+     unsigned count = 0;
+ 
+     /* The brigade consists of zero-or-more small data buckets which
+-     * can be coalesced (the prefix), followed by the remainder of the
+-     * brigade.
+     * can be coalesced (referred to as the "prefix"), followed by the
+     * remainder of the brigade.
+      *
+      * Find the last bucket - if any - of that prefix.  count gives
+      * the number of buckets in the prefix.  The "prefix" must contain
+@@ -1628,24 +1643,97 @@
+          e != APR_BRIGADE_SENTINEL(bb)
+              && !APR_BUCKET_IS_METADATA(e)
+              && e->length != (apr_size_t)-1
+-             && e->length < COALESCE_BYTES
+-             && (bytes + e->length) < COALESCE_BYTES
+-             && (ctx == NULL
+-                 || bytes + ctx->bytes + e->length < COALESCE_BYTES);
+             && e->length <= COALESCE_BYTES
+             && (buffered + bytes + e->length) <= COALESCE_BYTES;
+          e = APR_BUCKET_NEXT(e)) {
+-        if (e->length) count++; /* don't count zero-length buckets */
+-        bytes += e->length;
+        /* don't count zero-length buckets */
+        if (e->length) {
+            bytes += e->length;
+            count++;
+        }
+     }
+
+    /* If there is room remaining and the next bucket is a data
+     * bucket, try to include it in the prefix to coalesce.  For a
+     * typical [HEAP] [FILE] HTTP response brigade, this handles
+     * merging the headers and the start of the body into a single TLS
+     * record. */
+    if (bytes + buffered > 0
+        && bytes + buffered < COALESCE_BYTES
+        && e != APR_BRIGADE_SENTINEL(bb)
+        && !APR_BUCKET_IS_METADATA(e)) {
+        apr_status_t rv = APR_SUCCESS;
+
+        /* For an indeterminate length bucket (PIPE/CGI/...), try a
+         * non-blocking read to have it morph into a HEAP.  If the
+         * read fails with EAGAIN, it is harmless to try a split
+         * anyway, split is ENOTIMPL for most PIPE-like buckets. */
+        if (e->length == (apr_size_t)-1) {
+            const char *discard;
+            apr_size_t ignore;
+
+            rv = apr_bucket_read(e, &discard, &ignore, APR_NONBLOCK_READ);
+            if (rv != APR_SUCCESS && !APR_STATUS_IS_EAGAIN(rv)) {
+                ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10232)
+                              "coalesce failed to read from %s bucket",
+                              e->type->name);
+                return AP_FILTER_ERROR;
+            }
+        }
+
+        if (rv == APR_SUCCESS) {
+            /* If the read above made the bucket morph, it may now fit
+             * entirely within the buffer.  Otherwise, split it so it does
+             * fit. */
+            if (e->length > COALESCE_BYTES
+                || e->length + buffered + bytes > COALESCE_BYTES) {
+                rv = apr_bucket_split(e, COALESCE_BYTES - (buffered + bytes));
+            }
+
+            if (rv == APR_SUCCESS && e->length == 0) {
+                /* As above, don't count in the prefix if the bucket is
+                 * now zero-length. */
+            }
+            else if (rv == APR_SUCCESS) {
+                ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c,
+                              "coalesce: adding %" APR_SIZE_T_FMT " bytes "
+                              "from split %s bucket, total %" APR_SIZE_T_FMT,
+                              e->length, e->type->name, bytes + buffered);
+
+                count++;
+                bytes += e->length;
+                e = APR_BUCKET_NEXT(e);
+            }
+            else if (rv != APR_ENOTIMPL) {
+                ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10233)
+                              "coalesce: failed to split data bucket");
+                return AP_FILTER_ERROR;
+            }
+        }
+    }
+
+     upto = e;
+ 
+-    /* Coalesce the prefix, if:
+-     * a) more than one bucket is found to coalesce, or
+-     * b) the brigade contains only a single data bucket, or
+-     * c) the data bucket is not last but we have buffered data already.
+    /* Coalesce the prefix, if any of the following are true:
+     * 
+     * a) the prefix is more than one bucket
+     * OR
+     * b) the prefix is the entire brigade, which is a single bucket
+     *    AND the prefix length is smaller than the buffer size,
+     * OR
+     * c) the prefix is a single bucket
+     *    AND there is buffered data from a previous pass.
+     * 
+     * The aim with (b) is to buffer a small bucket so it can be
+     * coalesced with future invocations of this filter.  e.g.  three
+     * calls each with a single 100 byte HEAP bucket should get
+     * coalesced together.  But an invocation with a 8192 byte HEAP
+     * should pass through untouched.
+      */
+     if (bytes > 0
+         && (count > 1
+-            || (upto == APR_BRIGADE_SENTINEL(bb))
+            || (upto == APR_BRIGADE_SENTINEL(bb)
+                && bytes < COALESCE_BYTES)
+             || (ctx && ctx->bytes > 0))) {
+         /* If coalescing some bytes, ensure a context has been
+          * created. */
+@@ -1656,7 +1744,8 @@
+ 
+         ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c,
+                       "coalesce: have %" APR_SIZE_T_FMT " bytes, "
+-                      "adding %" APR_SIZE_T_FMT " more", ctx->bytes, bytes);
+                      "adding %" APR_SIZE_T_FMT " more (buckets=%u)",
+                      ctx->bytes, bytes, count);
+ 
+         /* Iterate through the prefix segment.  For non-fatal errors
+          * in this loop it is safe to break out and fall back to the
+@@ -1671,7 +1760,8 @@
+             if (APR_BUCKET_IS_METADATA(e)
+                 || e->length == (apr_size_t)-1) {
+                 ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(02012)
+-                              "unexpected bucket type during coalesce");
+                              "unexpected %s bucket during coalesce",
+                              e->type->name);
+                 break; /* non-fatal error; break out */
+             }
+ 
--- a/httpd-2.4.43-sslmultiproxy.patch
+++ b/httpd-2.4.43-sslmultiproxy.patch
@ -0,0 +1,118 @@
+diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
+index 12617b2..0fe7464 100644
+--- a/modules/ssl/mod_ssl.c
+++ b/modules/ssl/mod_ssl.c
+@@ -459,6 +459,10 @@ static int ssl_hook_pre_config(apr_pool_t *pconf,
+     return OK;
+ }
+ 
+static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable;
+static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set;
+
+
+ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
+                                            ap_conf_vector_t *per_dir_config,
+                                            int new_proxy)
+@@ -466,6 +470,10 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
+     SSLConnRec *sslconn = myConnConfig(c);
+     int need_setup = 0;
+ 
+    if (othermod_engine_disable) {
+        othermod_engine_disable(c);
+    }
+
+     /* mod_proxy's (r->)per_dir_config has the lifetime of the request, thus
+      * it uses ssl_engine_set() to reset sslconn->dc when reusing SSL backend
+      * connections, so we must fall through here. But in the case where we are
+@@ -544,6 +552,10 @@ static int ssl_engine_set(conn_rec *c,
+ {
+     SSLConnRec *sslconn;
+     int status;
+
+    if (othermod_engine_set) {
+        return othermod_engine_set(c, per_dir_config, proxy, enable);
+    }
+     
+     if (proxy) {
+         sslconn = ssl_init_connection_ctx(c, per_dir_config, 1);
+@@ -572,12 +584,18 @@ static int ssl_engine_set(conn_rec *c,
+ 
+ static int ssl_proxy_enable(conn_rec *c)
+ {
+-    return ssl_engine_set(c, NULL, 1, 1);
+    if (othermod_engine_set)
+        return othermod_engine_set(c, NULL, 1, 1);
+    else
+        return ssl_engine_set(c, NULL, 1, 1);
+ }
+ 
+ static int ssl_engine_disable(conn_rec *c)
+ {
+-    return ssl_engine_set(c, NULL, 0, 0);
+    if (othermod_engine_set)
+        return othermod_engine_set(c, NULL, 0, 0);
+    else
+        return ssl_engine_set(c, NULL, 0, 0);
+ }
+ 
+ int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
+@@ -753,6 +771,9 @@ static void ssl_register_hooks(apr_pool_t *p)
+                       APR_HOOK_MIDDLE);
+ 
+     ssl_var_register(p);
+    
+    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
+    othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set);
+ 
+     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
+     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
+diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
+index 5724f18..81c56ba 100644
+--- a/modules/ssl/ssl_engine_vars.c
+++ b/modules/ssl/ssl_engine_vars.c
+@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
+ static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
+ static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
+ static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
+ 
+ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
+ {
+@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
+ static int ssl_is_https(conn_rec *c)
+ {
+     SSLConnRec *sslconn = ssl_get_effective_config(c);
+-    return sslconn && sslconn->ssl;
+
+    return (sslconn && sslconn->ssl)
+        || (othermod_is_https && othermod_is_https(c));
+ }
+ 
+ static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
+@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p)
+ {
+     char *cp, *cp2;
+ 
+    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
+    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
+
+     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
+     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
+     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
+@@ -271,6 +278,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
+      */
+     if (result == NULL && c != NULL) {
+         SSLConnRec *sslconn = ssl_get_effective_config(c);
+
+        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
+            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
+            /* For an SSL_* variable, if mod_ssl is not enabled for
+             * this connection and another SSL module is present, pass
+             * through to that module. */
+            return othermod_var_lookup(p, s, c, r, var);
+        }
+
+         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
+             && sslconn && sslconn->ssl)
+             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);
--- a/httpd-2.4.43-sslprotdefault.patch
+++ b/httpd-2.4.43-sslprotdefault.patch
@ -0,0 +1,99 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 27e7a53..b53f3f8 100644
+--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
+@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
+     mctx->ticket_key          = NULL;
+ #endif
+ 
+-    mctx->protocol            = SSL_PROTOCOL_DEFAULT;
+    mctx->protocol            = SSL_PROTOCOL_NONE;
+     mctx->protocol_set        = 0;
+ 
+     mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
+@@ -263,6 +263,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+     if (add->protocol_set) {
+         mrg->protocol_set = 1;
+         mrg->protocol = add->protocol;
+        mrg->protocol_set = 1;
+     }
+     else {
+         mrg->protocol_set = base->protocol_set;
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index bfad47a..b0fcf81 100644
+--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
+@@ -577,6 +577,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
+     char *cp;
+     int protocol = mctx->protocol;
+    int protocol_set = mctx->protocol_set;
+     SSLSrvConfigRec *sc = mySrvConfig(s);
+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L
+     int prot;
+@@ -586,12 +587,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+      *  Create the new per-server SSL context
+      */
+     if (protocol == SSL_PROTOCOL_NONE) {
+-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
+-                "No SSL protocols available [hint: SSLProtocol]");
+-        return ssl_die(s);
+-    }
+        if (protocol_set) {
+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
+                    "No SSL protocols available [hint: SSLProtocol]");
+            return ssl_die(s);
+        }
+ 
+-    cp = apr_pstrcat(p,
+        ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, 
+                     "Using OpenSSL/system default SSL/TLS protocols");
+        cp = "default";
+    }
+    else {
+        cp = apr_pstrcat(p,
+ #ifndef OPENSSL_NO_SSL3
+                      (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
+ #endif
+@@ -604,7 +611,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+ #endif
+ #endif
+                      NULL);
+-    cp[strlen(cp)-2] = NUL;
+        cp[strlen(cp)-2] = NUL;
+    }
+ 
+     ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
+                  "Creating new SSL context (protocols: %s)", cp);
+@@ -705,13 +713,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+         prot = SSL3_VERSION;
+ #endif
+     } else {
+-        SSL_CTX_free(ctx);
+-        mctx->ssl_ctx = NULL;
+-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
+-                "No SSL protocols available [hint: SSLProtocol]");
+-        return ssl_die(s);
+        if (protocol_set) {
+            SSL_CTX_free(ctx);
+            mctx->ssl_ctx = NULL;
+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
+                    "No SSL protocols available [hint: SSLProtocol]");
+            return ssl_die(s);
+        }
+     }
+-    SSL_CTX_set_max_proto_version(ctx, prot);
+    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot);
+ 
+     /* Next we scan for the minimal protocol version we should provide,
+      * but we do not allow holes between max and min */
+@@ -731,7 +741,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+         prot = SSL3_VERSION;
+     }
+ #endif
+-    SSL_CTX_set_min_proto_version(ctx, prot);
+    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot);
+ #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
+ 
+ #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
--- a/httpd-2.4.46-lua-resume.patch
+++ b/httpd-2.4.46-lua-resume.patch
@ -0,0 +1,119 @@
+diff --git a/modules/lua/config.m4 b/modules/lua/config.m4
+index 29fd563..abeba1c 100644
+--- a/modules/lua/config.m4
+++ b/modules/lua/config.m4
+@@ -34,7 +34,7 @@ AC_DEFUN([CHECK_LUA_PATH], [dnl
+     fi
+ ])
+ 
+-dnl Check for Lua 5.3/5.2/5.1 Libraries
+dnl Check for Lua Libraries
+ dnl CHECK_LUA(ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND])
+ dnl Sets:
+ dnl  LUA_CFLAGS
+@@ -44,7 +44,7 @@ AC_DEFUN([CHECK_LUA],
+ 
+ AC_ARG_WITH(
+     lua,
+-    [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua 5.3/5.2/5.1 prefix])],
+    [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua installation prefix])],
+     lua_path="$withval",
+     :)
+ 
+diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c
+index 05f1e44..18b628c 100644
+--- a/modules/lua/mod_lua.c
+++ b/modules/lua/mod_lua.c
+@@ -342,7 +342,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
+ {
+     apr_pool_t *pool;
+     ap_lua_vm_spec *spec;
+-    int n, rc;
+    int n, rc, nres;
+     lua_State *L;
+     lua_filter_ctx *ctx;    
+     ap_lua_server_cfg *server_cfg = ap_get_module_config(r->server->module_config,
+@@ -410,7 +410,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
+             /* If a Lua filter is interested in filtering a request, it must first do a yield, 
+              * otherwise we'll assume that it's not interested and pretend we didn't find it.
+              */
+-            rc = lua_resume(L, 1);
+            rc = lua_resume(L, 1, &nres);
+             if (rc == LUA_YIELD) {
+                 if (f->frec->providers == NULL) { 
+                     /* Not wired by mod_filter */
+@@ -432,7 +432,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
+ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade *pbbIn)
+ {
+     request_rec *r = f->r;
+-    int rc;
+    int rc, nres;
+     lua_State *L;
+     lua_filter_ctx* ctx;
+     conn_rec *c = r->connection;
+@@ -492,7 +492,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
+             lua_setglobal(L, "bucket");
+             
+             /* If Lua yielded, it means we have something to pass on */
+-            if (lua_resume(L, 0) == LUA_YIELD) {
+            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
+                 size_t olen;
+                 const char* output = lua_tolstring(L, 1, &olen);
+                 if (olen > 0) { 
+@@ -524,7 +524,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
+             apr_bucket *pbktEOS;
+             lua_pushnil(L);
+             lua_setglobal(L, "bucket");
+-            if (lua_resume(L, 0) == LUA_YIELD) {
+            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
+                 apr_bucket *pbktOut;
+                 size_t olen;
+                 const char* output = lua_tolstring(L, 1, &olen);
+@@ -558,7 +558,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
+                                        apr_off_t nBytes) 
+ {
+     request_rec *r = f->r;
+-    int rc, lastCall = 0;
+    int rc, lastCall = 0, nres;
+     lua_State *L;
+     lua_filter_ctx* ctx;
+     conn_rec *c = r->connection;
+@@ -621,7 +621,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
+             lua_setglobal(L, "bucket");
+             
+             /* If Lua yielded, it means we have something to pass on */
+-            if (lua_resume(L, 0) == LUA_YIELD) {
+            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
+                 size_t olen;
+                 const char* output = lua_tolstring(L, 1, &olen);
+                 pbktOut = apr_bucket_heap_create(output, olen, 0, c->bucket_alloc);
+@@ -643,7 +643,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
+             apr_bucket *pbktEOS = apr_bucket_eos_create(c->bucket_alloc);
+             lua_pushnil(L);
+             lua_setglobal(L, "bucket");
+-            if (lua_resume(L, 0) == LUA_YIELD) {
+            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
+                 apr_bucket *pbktOut;
+                 size_t olen;
+                 const char* output = lua_tolstring(L, 1, &olen);
+diff --git a/modules/lua/mod_lua.h b/modules/lua/mod_lua.h
+index 0e49cdc..72b4de7 100644
+--- a/modules/lua/mod_lua.h
+++ b/modules/lua/mod_lua.h
+@@ -48,7 +48,15 @@
+ #if LUA_VERSION_NUM > 501
+ /* Load mode for lua_load() */
+ #define lua_load(a,b,c,d)  lua_load(a,b,c,d,NULL)
+-#define lua_resume(a,b)    lua_resume(a, NULL, b)
+
+#if LUA_VERSION_NUM > 503
+#define lua_resume(a,b,c)    lua_resume(a, NULL, b, c)
+#else
+/* ### For version < 5.4, assume that exactly one stack item is on the
+ * stack, which is what the code did before but seems dubious. */
+#define lua_resume(a,b,c)    (*(c) = 1, lua_resume(a, NULL, b))
+#endif
+
+ #define luaL_setfuncs_compat(a,b) luaL_setfuncs(a,b,0)
+ #else
+ #define lua_rawlen(L,i)    lua_objlen(L, (i))
--- a/httpd-init.service
+++ b/httpd-init.service
@ -0,0 +1,12 @@
+[Unit]
+Description=One-time temporary TLS key generation for httpd.service
+Documentation=man:httpd-init.service(8)
+
+ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt
+ConditionPathExists=|!/etc/pki/tls/private/localhost.key
+
+[Service]
+Type=oneshot
+RemainAfterExit=no
+
+ExecStart=/usr/libexec/httpd-ssl-gencerts
--- a/39
+++ b/39
@ -0,0 +1,39 @@
+#!/usr/bin/bash
+
+set -e
+
+FQDN=`hostname`
+ssldotconf=/etc/httpd/conf.d/ssl.conf
+
+if test -f /etc/pki/tls/certs/localhost.crt -a \
+        -f /etc/pki/tls/private/localhost.key; then
+    exit 0
+fi
+
+if test -f /etc/pki/tls/certs/localhost.crt -a \
+        ! -f /etc/pki/tls/private/localhost.key; then
+    echo "Missing certificate key!"
+    exit 1
+fi
+
+if test ! -f /etc/pki/tls/certs/localhost.crt -a \
+         -f /etc/pki/tls/private/localhost.key; then
+    echo "Missing certificate, but key is present!"
+    exit 1
+fi
+
+if ! test -f ${ssldotconf} || \
+   ! grep -q '^SSLCertificateFile /etc/pki/tls/certs/localhost.crt' ${ssldotconf} || \
+   ! grep -q '^SSLCertificateKeyFile /etc/pki/tls/private/localhost.key' ${ssldotconf}; then
+    # Non-default configuration, do nothing.
+    exit 0
+fi
+
+sscg -q                                                             \
+     --cert-file           /etc/pki/tls/certs/localhost.crt         \
+     --cert-key-file       /etc/pki/tls/private/localhost.key       \
+     --ca-file             /etc/pki/tls/certs/localhost.crt         \
+     --lifetime            365                                      \
+     --hostname            $FQDN                                    \
+     --email               root@$FQDN
+
--- a/3
+++ b/3
@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec /bin/systemd-ask-password "Enter TLS private key passphrase for $1 ($2) : "
--- a/httpd.conf
+++ b/httpd.conf
@ -0,0 +1,356 @@
+#
+# This is the main Apache HTTP server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
+# In particular, see 
+# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
+# for a discussion of each configuration directive.
+#
+# See the httpd.conf(5) man page for more information on this configuration,
+# and httpd.service(8) on using and configuring the httpd service.
+#
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# Configuration and logfile names: If the filenames you specify for many
+# of the server's control files begin with "/" (or "drive:/" for Win32), the
+# server will use that explicit path.  If the filenames do *not* begin
+# with "/", the value of ServerRoot is prepended -- so 'log/access_log'
+# with ServerRoot set to '/www' will be interpreted by the
+# server as '/www/log/access_log', where as '/log/access_log' will be
+# interpreted as '/log/access_log'.
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# Do not add a slash at the end of the directory path.  If you point
+# ServerRoot at a non-local disk, be sure to specify a local disk on the
+# Mutex directive, if file-based mutexes are used.  If you wish to share the
+# same ServerRoot for multiple httpd daemons, you will need to change at
+# least PidFile.
+#
+ServerRoot "/etc/httpd"
+
+#
+# Listen: Allows you to bind Apache to specific IP addresses and/or
+# ports, instead of the default. See also the <VirtualHost>
+# directive.
+#
+# Change this to Listen on specific IP addresses as shown below to 
+# prevent Apache from glomming onto all bound IP addresses.
+#
+#Listen 12.34.56.78:80
+Listen 80
+
+#
+# Dynamic Shared Object (DSO) Support
+#
+# To be able to use the functionality of a module which was built as a DSO you
+# have to place corresponding `LoadModule' lines at this location so the
+# directives contained in it are actually available _before_ they are used.
+# Statically compiled modules (those listed by `httpd -l') do not need
+# to be loaded here.
+#
+# Example:
+# LoadModule foo_module modules/mod_foo.so
+#
+Include conf.modules.d/*.conf
+
+#
+# If you wish httpd to run as a different user or group, you must run
+# httpd as root initially and it will switch.  
+#
+# User/Group: The name (or #number) of the user/group to run httpd as.
+# It is usually good practice to create a dedicated user and group for
+# running httpd, as with most system services.
+#
+User apache
+Group apache
+
+# 'Main' server configuration
+#
+# The directives in this section set up the values used by the 'main'
+# server, which responds to any requests that aren't handled by a
+# <VirtualHost> definition.  These values also provide defaults for
+# any <VirtualHost> containers you may define later in the file.
+#
+# All of these directives may appear inside <VirtualHost> containers,
+# in which case these default settings will be overridden for the
+# virtual host being defined.
+#
+
+#
+# ServerAdmin: Your address, where problems with the server should be
+# e-mailed.  This address appears on some server-generated pages, such
+# as error documents.  e.g. admin@your-domain.com
+#
+ServerAdmin root@localhost
+
+#
+# ServerName gives the name and port that the server uses to identify itself.
+# This can often be determined automatically, but we recommend you specify
+# it explicitly to prevent problems during startup.
+#
+# If your host doesn't have a registered DNS name, enter its IP address here.
+#
+#ServerName www.example.com:80
+
+#
+# Deny access to the entirety of your server's filesystem. You must
+# explicitly permit access to web content directories in other 
+# <Directory> blocks below.
+#
+<Directory />
+    AllowOverride none
+    Require all denied
+</Directory>
+
+#
+# Note that from this point forward you must specifically allow
+# particular features to be enabled - so if something's not working as
+# you might expect, make sure that you have specifically enabled it
+# below.
+#
+
+#
+# DocumentRoot: The directory out of which you will serve your
+# documents. By default, all requests are taken from this directory, but
+# symbolic links and aliases may be used to point to other locations.
+#
+DocumentRoot "/var/www/html"
+
+#
+# Relax access to content within /var/www.
+#
+<Directory "/var/www">
+    AllowOverride None
+    # Allow open access:
+    Require all granted
+</Directory>
+
+# Further relax access to the default document root:
+<Directory "/var/www/html">
+    #
+    # Possible values for the Options directive are "None", "All",
+    # or any combination of:
+    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
+    #
+    # Note that "MultiViews" must be named *explicitly* --- "Options All"
+    # doesn't give it to you.
+    #
+    # The Options directive is both complicated and important.  Please see
+    # http://httpd.apache.org/docs/2.4/mod/core.html#options
+    # for more information.
+    #
+    Options Indexes FollowSymLinks
+
+    #
+    # AllowOverride controls what directives may be placed in .htaccess files.
+    # It can be "All", "None", or any combination of the keywords:
+    #   Options FileInfo AuthConfig Limit
+    #
+    AllowOverride None
+
+    #
+    # Controls who can get stuff from this server.
+    #
+    Require all granted
+</Directory>
+
+#
+# DirectoryIndex: sets the file that Apache will serve if a directory
+# is requested.
+#
+<IfModule dir_module>
+    DirectoryIndex index.html
+</IfModule>
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being 
+# viewed by Web clients. 
+#
+<Files ".ht*">
+    Require all denied
+</Files>
+
+#
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog "logs/error_log"
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+<IfModule log_config_module>
+    #
+    # The following directives define some format nicknames for use with
+    # a CustomLog directive (see below).
+    #
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b" common
+
+    <IfModule logio_module>
+      # You need to enable mod_logio.c to use %I and %O
+      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+    </IfModule>
+
+    #
+    # The location and format of the access logfile (Common Logfile Format).
+    # If you do not define any access logfiles within a <VirtualHost>
+    # container, they will be logged here.  Contrariwise, if you *do*
+    # define per-<VirtualHost> access logfiles, transactions will be
+    # logged therein and *not* in this file.
+    #
+    #CustomLog "logs/access_log" common
+
+    #
+    # If you prefer a logfile with access, agent, and referer information
+    # (Combined Logfile Format) you can use the following directive.
+    #
+    CustomLog "logs/access_log" combined
+</IfModule>
+
+<IfModule alias_module>
+    #
+    # Redirect: Allows you to tell clients about documents that used to 
+    # exist in your server's namespace, but do not anymore. The client 
+    # will make a new request for the document at its new location.
+    # Example:
+    # Redirect permanent /foo http://www.example.com/bar
+
+    #
+    # Alias: Maps web paths into filesystem paths and is used to
+    # access content that does not live under the DocumentRoot.
+    # Example:
+    # Alias /webpath /full/filesystem/path
+    #
+    # If you include a trailing / on /webpath then the server will
+    # require it to be present in the URL.  You will also likely
+    # need to provide a <Directory> section to allow access to
+    # the filesystem path.
+
+    #
+    # ScriptAlias: This controls which directories contain server scripts. 
+    # ScriptAliases are essentially the same as Aliases, except that
+    # documents in the target directory are treated as applications and
+    # run by the server when requested rather than as documents sent to the
+    # client.  The same rules about trailing "/" apply to ScriptAlias
+    # directives as to Alias.
+    #
+    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
+
+</IfModule>
+
+#
+# "/var/www/cgi-bin" should be changed to whatever your ScriptAliased
+# CGI directory exists, if you have that configured.
+#
+<Directory "/var/www/cgi-bin">
+    AllowOverride None
+    Options None
+    Require all granted
+</Directory>
+
+<IfModule mime_module>
+    #
+    # TypesConfig points to the file containing the list of mappings from
+    # filename extension to MIME-type.
+    #
+    TypesConfig /etc/mime.types
+
+    #
+    # AddType allows you to add to or override the MIME configuration
+    # file specified in TypesConfig for specific file types.
+    #
+    #AddType application/x-gzip .tgz
+    #
+    # AddEncoding allows you to have certain browsers uncompress
+    # information on the fly. Note: Not all browsers support this.
+    #
+    #AddEncoding x-compress .Z
+    #AddEncoding x-gzip .gz .tgz
+    #
+    # If the AddEncoding directives above are commented-out, then you
+    # probably should define those extensions to indicate media types:
+    #
+    AddType application/x-compress .Z
+    AddType application/x-gzip .gz .tgz
+
+    #
+    # AddHandler allows you to map certain file extensions to "handlers":
+    # actions unrelated to filetype. These can be either built into the server
+    # or added with the Action directive (see below)
+    #
+    # To use CGI scripts outside of ScriptAliased directories:
+    # (You will also need to add "ExecCGI" to the "Options" directive.)
+    #
+    #AddHandler cgi-script .cgi
+
+    # For type maps (negotiated resources):
+    #AddHandler type-map var
+
+    #
+    # Filters allow you to process content before it is sent to the client.
+    #
+    # To parse .shtml files for server-side includes (SSI):
+    # (You will also need to add "Includes" to the "Options" directive.)
+    #
+    AddType text/html .shtml
+    AddOutputFilter INCLUDES .shtml
+</IfModule>
+
+#
+# Specify a default charset for all content served; this enables
+# interpretation of all content as UTF-8 by default.  To use the 
+# default browser choice (ISO-8859-1), or to allow the META tags
+# in HTML content to override this choice, comment out this
+# directive:
+#
+AddDefaultCharset UTF-8
+
+<IfModule mime_magic_module>
+    #
+    # The mod_mime_magic module allows the server to use various hints from the
+    # contents of the file itself to determine its type.  The MIMEMagicFile
+    # directive tells the module where the hint definitions are located.
+    #
+    MIMEMagicFile conf/magic
+</IfModule>
+
+#
+# Customizable error responses come in three flavors:
+# 1) plain text 2) local redirects 3) external redirects
+#
+# Some examples:
+#ErrorDocument 500 "The server made a boo boo."
+#ErrorDocument 404 /missing.html
+#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
+#ErrorDocument 402 http://www.example.com/subscription_info.html
+#
+
+#
+# EnableMMAP and EnableSendfile: On systems that support it, 
+# memory-mapping or the sendfile syscall may be used to deliver
+# files.  This usually improves server performance, but must
+# be turned off when serving from networked-mounted 
+# filesystems or if support for these functions is otherwise
+# broken on your system.
+# Defaults if commented: EnableMMAP On, EnableSendfile Off
+#
+#EnableMMAP off
+EnableSendfile on
+
+# Supplemental configuration
+#
+# Load config files in the "/etc/httpd/conf.d" directory, if any.
+IncludeOptional conf.d/*.conf
--- a/httpd.conf.xml
+++ b/httpd.conf.xml
@ -0,0 +1,259 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+
+]>
+<!--
+ Copyright 2018 Red Hat, Inc.
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<refentry>
+  <refentryinfo>
+    <title>httpd.conf</title>
+    <productname>httpd</productname>
+    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>httpd.conf</refentrytitle>
+    <manvolnum>5</manvolnum>
+  </refmeta>
+  
+  <refnamediv>
+    <refname>httpd.conf</refname>
+    <refpurpose>Configuration files for httpd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para>
+      <filename>/etc/httpd/conf/httpd.conf</filename>, 
+      <filename>/etc/httpd/conf.modules.d</filename>,
+      <filename>/etc/httpd/conf.d</filename>
+    </para>
+  </refsynopsisdiv>
+  
+  <refsect1>
+    <title>Description</title>
+
+    <para>The main configuration file for the <command>httpd</command> daemon is
+    <filename>/etc/httpd/conf/httpd.conf</filename>.  The syntax of
+    this file is described at <ulink
+    url="https://httpd.apache.org/docs/2.4/configuring.html"/>, and
+    the full set of available directives is listed at <ulink
+    url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>.
+    </para>
+
+    <refsect2>
+      <title>Configuration structure</title>
+
+      <para>The main configuration file
+      (<filename>httpd.conf</filename>) sets up various defaults and
+      includes configuration files from two directories -
+      <filename>/etc/httpd/conf.modules.d</filename> and
+      <filename>/etc/httpd/conf.d</filename>.  Packages containing
+      loadable modules (like <option>mod_ssl.so</option>) place files
+      in the <filename>conf.modules.d</filename> directory with the
+      appropriate <option>LoadModule</option> directive so that module
+      is loaded by default.</para>
+
+      <para>Some notable configured defaults are:</para>
+
+      <variablelist>
+        <varlistentry>
+          <term><option>DocumentRoot @DOCROOT@/html</option></term>
+          <listitem><para>The default document root from which content
+          is served.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>Listen 80</option></term>
+          <listitem><para>The daemon listens on TCP port 80.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>ErrorLog "logs/error_log"</option></term>
+          <listitem><para>Error messages are logged to
+          <filename>@LOGDIR@/error_log</filename>.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>ScriptAlias /cgi-bin/ "@DOCROOT@/cgi-bin/"</option></term>
+          <listitem><para>CGI scripts are served via the URL-path <option>/cgi-bin/</option>.</para></listitem>
+        </varlistentry>
+        
+      </variablelist>
+
+      <para>To remove any of the default configuration provided in
+      separate files covered below, replace that file with an empty
+      file rather than removing it from the filesystem, otherwise it
+      may be restored to the original when the package which provides
+      it is upgraded.</para>
+      
+    </refsect2>
+
+    <refsect2>
+      <title>MPM configuration</title>
+
+      <para>The configuration file at
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename> is
+      used to select the multi-processing module (MPM), which governs
+      how <command>httpd</command> divides work between processes
+      and/or threads at run-time.  Exactly one
+      <option>LoadModule</option> directive must be uncommented in
+      this file; by default the <option>@MPM@</option> MPM is enabled.
+      For more information on MPMs, see <ulink
+      url="https://httpd.apache.org/docs/2.4/mpm.html"/>.</para>
+
+      <para>If using the <emphasis>prefork</emphasis> MPM, the
+      "httpd_graceful_shutdown" SELinux boolean should also be
+      enabled, since with this MPM, httpd needs to establish TCP
+      connections to local ports to successfully complete a graceful
+      restart or shutdown. This boolean can be enabled by running the
+      command: <command>semanage boolean -m --on
+      httpd_graceful_shutdown</command></para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Module configuration files</title>
+      
+      <para>Module configuration files are provided in the
+      <filename>/etc/httpd/conf.modules.d/</filename> directory.
+      Filenames in this directory are by convention prefixed with two
+      digit numeric prefix to ensure they are processed in the desired
+      order.  Core modules provided with the <command>httpd</command>
+      package are loaded by files with a <option>0x-</option> prefix
+      to ensure these load first.  Only filenames with a
+      <option>.conf</option> suffix in this directory will be
+      processed.</para>
+
+      <para>Other provided configuration files are listed below.
+      
+      <variablelist>
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-base.conf</filename></term>
+          <listitem><para>The set of core modules included with
+          <command>httpd</command> which are all loaded by
+          default.</para></listitem>
+        </varlistentry>
+        
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-optional.conf</filename></term>
+          <listitem><para>The set of non-core modules included with
+          <command>httpd</command> which are <emphasis>not</emphasis>
+          loaded by default.</para></listitem>
+        </varlistentry>
+        
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-systemd.conf</filename></term>
+          <listitem><para>This file loads <option>mod_systemd</option>
+          which is necessary for the correct operation of the
+          <command>httpd.service</command> systemd unit, and should
+          not be removed or disabled.</para></listitem>
+        </varlistentry>
+      </variablelist>
+      </para>
+    </refsect2>
+        
+    <refsect2>
+      <title>Other configuration files</title>
+
+      <para>Default module configuration files and site-specific
+      configuration files are loaded from the
+      <filename>/etc/httpd/conf.d/</filename> directory.  Only files
+      with a <option>.conf</option> suffix will be loaded.  The
+      following files are provided:
+
+      <variablelist>
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/userdir.conf</filename></term>
+          <listitem><para>This file gives an example configuration for
+          <option>mod_userdir</option> to map URLs such as
+          <option>http://localhost/~jim/</option> to
+          <filename>/home/jim/public_html/</filename>. Userdir mapping
+          is disabled by default.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/autoindex.conf</filename></term>
+          <listitem><para>This file provides the default configuration
+          for <option>mod_autoindex</option> which generates HTML
+          directory listings when enabled.  It also makes file icon
+          image files available at the <option>/icons/</option>
+          URL-path.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/welcome.conf</filename></term>
+          <listitem><para>This file enables a "welcome page" at
+          <option>http://localhost/</option> if no content is present
+          in the default documentation root
+          <filename>/var/www/html</filename>.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/ssl.conf</filename> (present only if <option>mod_ssl</option> is installed)</term>
+          <listitem><para>This file configures a TLS
+          <option>VirtualHost</option> listening on port
+          <option>443</option>.  If the default configuration is used,
+          the referenced test certificate and private key are
+          generated the first time <command>httpd.service</command> is
+          started; see
+          <citerefentry><refentrytitle>httpd-init.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+          for more information.</para></listitem>
+        </varlistentry>
+        
+      </variablelist></para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Instantiated services</title>
+
+      <para>As an alternative to (or in addition to) the
+      <command>httpd.service</command> unit, the instantiated template
+      service <command>httpd@.service</command> unit file can be used,
+      which starts <command>httpd</command> using a different
+      configuration file to the default. For example,
+      <command>systemctl start httpd@foobar.service</command> will
+      start httpd using the configuration file
+      <filename>/etc/httpd/conf/foobar.conf</filename>.  See <citerefentry><refentrytitle>httpd@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> for more information.</para>
+    </refsect2>
+      
+  </refsect1>
+  <refsect1>
+    <title>Files</title>
+
+    <para>
+      <filename>/etc/httpd/conf/httpd.conf</filename>, 
+      <filename>/etc/httpd/conf.d</filename>, 
+      <filename>/etc/httpd/conf.modules.d</filename>
+    </para>
+  </refsect1>
+  
+  <refsect1>
+    <title>See also</title>
+
+    <para>
+    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 
+    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <ulink url="https://httpd.apache.org/docs/2.4/configuring.html"/>,
+    <ulink url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>
+    </para>
+  </refsect1>
+
+</refentry>
+
+<!-- LocalWords:  systemd PidFile
+-->
--- a/httpd.logrotate
+++ b/httpd.logrotate
@ -0,0 +1,11 @@
+# Note that logs are not compressed unless "compress" is configured,
+# which can be done either here or globally in /etc/logrotate.conf.
+/var/log/httpd/*log {
+    missingok
+    notifempty
+    sharedscripts
+    delaycompress
+    postrotate
+        /bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true
+    endscript
+}
--- a/httpd.service
+++ b/httpd.service
@ -0,0 +1,32 @@
+# See httpd.service(8) for more information on using the httpd service.
+
+# Modifying this file in-place is not recommended, because changes
+# will be overwritten during package upgrades.  To customize the
+# behaviour, run "systemctl edit httpd" to create an override unit.
+
+# For example, to pass additional options (such as -D definitions) to
+# the httpd binary at startup, create an override unit (as is done by
+# systemctl edit) and enter the following:
+
+#	[Service]
+#	Environment=OPTIONS=-DMY_DEFINE
+
+[Unit]
+Description=The Apache HTTP Server
+Wants=httpd-init.service
+After=network.target remote-fs.target nss-lookup.target httpd-init.service
+Documentation=man:httpd.service(8)
+
+[Service]
+Type=notify
+Environment=LANG=C
+
+ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND
+ExecReload=/usr/sbin/httpd $OPTIONS -k graceful
+# Send SIGWINCH for graceful stop
+KillSignal=SIGWINCH
+KillMode=mixed
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
--- a/httpd.service.xml
+++ b/httpd.service.xml
@ -0,0 +1,355 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+
+]>
+<!--
+ Copyright 2018 Red Hat, Inc.
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<refentry>
+  <refentryinfo>
+    <title>httpd systemd units</title>
+    <productname>httpd</productname>
+    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>httpd.service</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+  
+  <refnamediv>
+    <refname>httpd.service</refname>
+    <refname>httpd@.service</refname>
+    <refname>httpd.socket</refname>
+    <refname>httpd-init.service</refname>
+    <refpurpose>httpd unit files for systemd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para>
+      <filename>/usr/lib/systemd/system/httpd.service</filename>, 
+      <filename>/usr/lib/systemd/system/httpd@.service</filename>,
+      <filename>/usr/lib/systemd/system/httpd-init.service</filename>,
+      <filename>/usr/lib/systemd/system/httpd.socket</filename>
+    </para>
+  </refsynopsisdiv>
+  
+  <refsect1>
+    <title>Description</title>
+
+    <para>This manual page describes the <command>systemd</command>
+    unit files used to integrate the <command>httpd</command> daemon
+    with <command>systemd</command>. Two main unit files are
+    available: <command>httpd.service</command> allows the
+    <command>httpd</command> daemon to be run as a system service, and
+    <command>httpd.socket</command> allows httpd to be started via
+    socket-based activation. Most systems will use
+    <command>httpd.service</command>.</para>
+
+    <para>The <command>apachectl</command> command has been modified
+    to invoke <command>systemctl</command> for most uses, so for
+    example, running <command>apachectl start</command> is equivalent
+    to running <command>systemctl start httpd.service</command>.  This
+    ensures that the running httpd daemon is tracked and managed by
+    <command>systemd</command>.  In contrast, running
+    <command>httpd</command> directly from a root shell will start the
+    service outside of <command>systemd</command>; in this case,
+    default security restrictions described below (including, but not
+    limited to, SELinux) will not be enforced.</para>
+
+    <refsect2>
+      <title>Changing default behaviour</title>
+
+      <para>To change the default behaviour of the httpd service, an
+      <emphasis>over-ride</emphasis> file should be created, rather
+      than changing
+      <filename>/usr/lib/systemd/system/httpd.service</filename>
+      directly, since such changes would be lost over package
+      upgrades. Running <command>systemctl edit
+      httpd.service</command> or <command>systemctl edit
+      httpd.socket</command> as root will create a drop-in file (in
+      the former case, in
+      <filename>/etc/systemd/system/httpd.service.d</filename>) which
+      over-rides the system defaults.</para>
+
+      <para>For example, to set the <option>LD_LIBRARY_PATH</option>
+      environment variable for the daemon, run <command>systemctl edit
+      httpd.service</command> and enter:
+
+      <programlisting>[Service]
+Environment=LD_LIBRARY_PATH=/opt/vendor/lib</programlisting></para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Starting the service at boot time</title>
+
+      <para>The httpd.service and httpd.socket units are
+      <emphasis>disabled</emphasis> by default. To start the httpd
+      service at boot time, run: <command>systemctl enable
+      httpd.service</command>. In the default configuration, the
+      httpd daemon will accept connections on port 80 (and, if mod_ssl
+      is installed, TLS connections on port 443) for any configured
+      IPv4 or IPv6 address.</para>
+
+      <para>If httpd is configured to depend on any specific IP
+      address (for example, with a "Listen" directive) which may only
+      become available during start-up, or if httpd depends on other
+      services (such as a database daemon), the service
+      <emphasis>must</emphasis> be configured to ensure correct
+      start-up ordering.</para>
+
+      <para>For example, to ensure httpd is only running after all
+      configured network interfaces are configured, create a drop-in
+      file (as described above) with the following section:
+
+      <programlisting>[Unit]
+After=network-online.target
+Wants=network-online.target</programlisting>
+
+      See <ulink
+      url="https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/"/>
+      for more information on start-up ordering with systemd.</para>
+
+    </refsect2>
+
+    <refsect2>
+      <title>SSL/TLS certificate generation</title>
+
+      <para>The <command>httpd-init.service</command> unit is provided
+      with the mod_ssl package. This oneshot unit automatically
+      creates a TLS server certificate and key (using a generated
+      self-signed CA certificate and key) for testing purposes before
+      httpd is started. To inhibit certificate generation, use
+      <command>systemctl mask httpd-init.service</command> after
+      installing mod_ssl, and adjust the mod_ssl configuration to use
+      an appropriate certificate and key.</para>
+
+    </refsect2>
+
+    <refsect2>
+      <title>Reloading and stopping the service</title>
+
+      <para>When running <command>systemctl reload
+      httpd.service</command>, a <emphasis>graceful</emphasis>
+      restart is used, which sends a signal to the httpd parent
+      process to reload the configuration and re-open log files. Any
+      children with open connections at the time of reload will
+      terminate only once they have completed serving requests. This
+      prevents users of the server seeing errors (or potentially
+      losing data) due to the reload, but means some there is some
+      delay before any configuration changes take effect for all
+      users.</para>
+
+      <para>Similarly, a <emphasis>graceful stop</emphasis> is used
+      when <command>systemctl stop httpd.service</command> is run,
+      which terminates the server only once active connections have
+      been processed.</para>
+
+      <para>To "ungracefully" stop the server without waiting for
+      requests to complete, use <command>systemctl kill
+      --kill-who=main httpd</command>; similarly to "ungracefully"
+      reload the configuration, use <command>systemctl kill
+      --kill-who=main --signal=HUP httpd</command>.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>Automated service restarts</title>
+
+      <para>System packages (including the httpd package itself) may
+      restart the httpd service automatically after packages are
+      upgraded, installed, or removed. This is done using the
+      <command>systemctl try-restart httpd.service</command>, which
+      stops then starts the service if it is running.</para>
+
+      <para>To disable automatic restarts, create the file
+      <filename>/etc/sysconfig/httpd-disable-posttrans</filename>.
+      When <command>httpd</command> interfaces are added in an update,
+      it may not be safe to <emphasis>reload</emphasis> a running
+      service after upgrading, if updated modules require interfaces
+      only available in the updated httpd.  It is recommended to allow
+      automatic restarts for this reason.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>Changing the default MPM (Multi-Processing Module)</title>
+
+      <para>httpd offers a choice of multi-processing modules (MPMs),
+      which can be configured in
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.
+      See
+      <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information on changing the MPM.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>systemd integration and mod_systemd</title>
+
+      <para>The httpd service uses the <option>notify</option> systemd
+      service type. The <literal>mod_systemd</literal> module must be
+      loaded (as in the default configuration) for this to work
+      correctly - the service will fail if this module is not
+      loaded. <literal>mod_systemd</literal> also makes worker and
+      request statistics available when running <command>systemctl status
+      httpd</command>. See
+      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information on systemd service types.</para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Security and SELinux</title>
+
+      <para>The default SELinux policy restricts the httpd service in
+      various ways. For example, the default policy limits the ports
+      to which httpd can bind (using the <literal>Listen</literal>
+      directive), which parts of the filesystem can be accessed, and
+      whether outgoing TCP connections are possible. Many of these
+      restrictions can be relaxed or adjusted by using
+      <command>semanage</command> to change booleans or other
+      types. See
+      <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      for more information.</para>
+
+      <para>The httpd service enables <emphasis>PrivateTmp</emphasis>
+      by default. The <filename>/tmp</filename> and
+      <filename>/var/tmp</filename> directories available within the
+      httpd process (and CGI scripts, etc) are not shared by other
+      processes. See
+      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information.</para>
+
+    </refsect2>
+
+    <refsect2>
+      <title>Logging and log file rotation</title>
+
+      <para>The <command>httpd</command> daemon is configured to log
+      to the <filename>/var/log/httpd</filename> directory by default,
+      and a drop-in for <command>logrotate</command> is provided at
+      <filename>/etc/logrotate.d/httpd</filename> to enable log file
+      rotation.  The <command>httpd.service</command> systemd unit is
+      reloaded after a <command>logrotate</command> run.</para>
+
+      <para>Log file compression is not enabled by default; since
+      <command>httpd</command> can continue writing to open log files
+      for some time after a reload (graceful restart), if compression
+      is enabled the <literal>delaycompress</literal> option must be
+      present (as in the default) to delay compression of log files to
+      a later rotation run.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>Socket activation</title>
+
+      <para>Socket activation (see
+      <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information) can be used with <command>httpd</command>
+      by enabling the <command>httpd.socket</command> unit.  The
+      <command>httpd</command> listener configuration must exactly
+      match the <literal>ListenStream</literal> options configured for
+      the <command>httpd.socket</command> unit.  The default
+      <command>httpd.socket</command> has a
+      <literal>ListenStream=80</literal> and, if mod_ssl is installed,
+      <literal>ListenStream=443</literal> by a drop-in file. If
+      additional <literal>Listen</literal> directives are added to the
+      httpd configuration, corresponding
+      <literal>ListenStream</literal> options should be added via
+      drop-in files, for example via <command>systemctl edit
+      httpd.socket</command>.</para>
+
+      <para>If using socket activation with httpd, only one listener
+      on any given TCP port is supported; a configuration with both
+      "<literal>Listen 127.0.0.1:80</literal>" and "<literal>Listen
+      192.168.1.2:80</literal>" will not work.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>Instantiated services</title>
+
+      <para>The <command>httpd@.service</command> unit is a template
+      for creating instantiated services. An instance of this unit
+      will be started using the configuration file
+      <filename>/etc/httpd/conf/INSTANCE.conf</filename>, where
+      <emphasis>INSTANCE</emphasis> is replaced with the instance
+      name.  For example, <command>systemctl start
+      httpd@foobar.service</command> will start httpd using the
+      configuration file
+      <filename>/etc/httpd/conf/foobar.conf</filename>.  The
+      <option>HTTPD_INSTANCE</option> environment variable is set to
+      the instance name by the unit and is available for use within
+      the configuration file.</para>
+
+      <para>To allow multiple instances of httpd to run
+      simultaneously, a number of configuration directives must be
+      changed, such as <command>PidFile</command> and
+      <command>DefaultRuntimeDir</command> to pick non-conflicting
+      paths, and <command>Listen</command> to choose different ports.
+      The example configuration file
+      <filename>/usr/share/doc/httpd/instance.conf</filename>
+      demonstrates how to make such changes using the
+      <option>HTTPD_INSTANCE</option> variable.</para>
+
+      <para>It can be useful to configure instances of
+      <command>httpd@.service</command> to reload when
+      <command>httpd.service</command> is reloaded; for example,
+      <command>logrotate</command> will reload only
+      <command>httpd.service</command> when logs are rotated. If this
+      behaviour is required, create a drop-in file for the instance as
+      follows:
+
+      <programlisting>[Unit]
+ReloadPropagatedFrom=httpd.service</programlisting>
+
+      As with normal units, drop-in files for instances can be created
+      using <command>systemctl edit</command>, e.g. <command>systemctl edit
+      httpd@foobar.service</command>.</para>
+    </refsect2>
+
+  </refsect1>
+
+  <refsect1>
+    <title>Files</title>
+
+    <para><filename>/usr/lib/systemd/system/httpd.service</filename>,
+    <filename>/usr/lib/systemd/system/httpd.socket</filename>,
+    <filename>/usr/lib/systemd/system/httpd@.service</filename>,
+    <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
+  </refsect1>
+  
+  <refsect1>
+    <title>See also</title>
+
+    <para>
+    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 
+    <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
+    <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
+    <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>logrotate</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+
+</refentry>
+
+<!-- LocalWords:  systemd PidFile
+-->
--- a/httpd.socket
+++ b/httpd.socket
@ -0,0 +1,13 @@
+# See httpd.socket(8) for more information on using the httpd service.
+
+[Unit]
+Description=Apache httpd Server Socket
+Documentation=man:httpd.socket(8)
+
+[Socket]
+ListenStream=80
+NoDelay=true
+DeferAcceptSec=30
+
+[Install]
+WantedBy=sockets.target
--- a/httpd.spec
+++ b/httpd.spec
--- a/httpd.tmpfiles
+++ b/httpd.tmpfiles
@ -0,0 +1,2 @@
+d /run/httpd   710 root apache
+d /run/httpd/htcacheclean   700 apache apache
--- a/httpd@.service
+++ b/httpd@.service
@ -0,0 +1,25 @@
+# This is a template for httpd instances.
+# See httpd@.service(8) for more information.
+
+[Unit]
+Description=The Apache HTTP Server
+After=network.target remote-fs.target nss-lookup.target
+Documentation=man:httpd@.service(8)
+
+[Service]
+Type=notify
+Environment=LANG=C
+Environment=HTTPD_INSTANCE=%i
+ExecStartPre=/bin/mkdir -m 710 -p /run/httpd/instance-%i
+ExecStartPre=/bin/chown root.apache /run/httpd/instance-%i
+ExecStartPre=/bin/mkdir -m 700 -p /var/lib/httpd/instance-%i
+ExecStartPre=/bin/chown apache.apache /var/lib/httpd/instance-%i
+ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND -f conf/%i.conf
+ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
+# Send SIGWINCH for graceful stop
+KillSignal=SIGWINCH
+KillMode=mixed
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
--- a/instance.conf
+++ b/instance.conf
@ -0,0 +1,24 @@
+#
+# This is an example instance-specific configuration file. See the
+# httpd@.service(8) man page for detailed information on using the
+# the httpd@.service with instances.
+#
+# To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf
+# This config will then used as the default configuration when
+# running:
+#
+#   # systemctl start httpd@foobar.service
+#
+# The changes compared to the default are:
+# - DefaultRuntime, DefaultStateDir and Pidfile renamed to instance-specific
+# - default logfile names are prefixed with the instance name
+# - /etc/httpd/conf.d is NOT included by default (conf.modules.d still is)
+#
+# Further customisations will be required for an instance to run
+# simultaneously to httpd.service under the default configuration,
+# e.g. changing the port used with Listen.
+#
+
+DefaultRuntimeDir /run/httpd/instance-${HTTPD_INSTANCE}
+DefaultStateDir /var/lib/httpd/instance-${HTTPD_INSTANCE}
+PidFile /run/httpd/instance-${HTTPD_INSTANCE}.pid
--- a/manual.conf
+++ b/manual.conf
@ -0,0 +1,13 @@
+#
+# This configuration file allows the manual to be accessed at 
+# http://localhost/manual/
+#
+Alias /manual /usr/share/httpd/manual
+
+<Directory "/usr/share/httpd/manual">
+    Options Indexes
+    AllowOverride None
+    Require all granted
+
+    RedirectMatch 301 ^/manual/(?:da|de|en|es|fr|ja|ko|pt-br|ru|tr|zh-cn)(/.*)$ "/manual$1"
+</Directory>
--- a/1
+++ b/1
@ -0,0 +1 @@
+http://www.apache.org/dist/httpd/
--- a/mkstatus.sh
+++ b/mkstatus.sh
@ -0,0 +1,20 @@
+#!/bin/sh
+echo '<?xml version="1.0" encoding="UTF-8"?>'
+echo '<patches>'
+for f in $*; do
+  n=${f//httpd-2\.[0-9]\.[0-9][0-9]-/}
+  n=${n//.patch/}
+  s_HEAD=`grep ^Upstream-HEAD $f | sed 's/Upstream-HEAD: //'`
+  s_20=`grep ^Upstream-2.0: $f | sed 's/Upstream-2.0: //'`
+  s_Com=`grep ^Upstream-Status: $f | sed 's/Upstream-Status: //'`
+  s_PR=`grep ^Upstream-PR: $f | sed 's/Upstream-PR: //'`
+  printf ' <patch name="%s">\n' $n
+  printf '  <status branch="HEAD">%s</status>\n' "$s_HEAD"
+  printf '  <status branch="2.0">%s</status>\n' "$s_20"
+  printf '  <comment>%s</comment>\n' "$s_Com"
+  if [ -n "$s_PR" ]; then
+    printf '  <bug pr="%s"/>\n' "$s_PR"
+  fi
+  printf ' </patch>\n'
+done
+echo '</patches>'
--- a/pullrev.sh
+++ b/pullrev.sh
@ -0,0 +1,65 @@
+#!/bin/sh -e
+
+if [ $# -lt 1 ]; then
+    echo "What?"
+    exit 1
+fi
+
+repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.43
+prefix="httpd-${ver}"
+suffix="${SUFFIX:-r$1${2:++}}"
+fn="${prefix}-${suffix}.patch"
+vcurl="http://svn.apache.org/viewvc?view=revision&revision="
+
+if test -f ${fn}; then
+    mv -v -f ${fn} ${fn}\~
+    echo "# $0 $*" > ${fn}
+    sed '1{/#.*pullrev/d;};/^--- /,$d' < ${fn}\~ >> ${fn}
+else
+    echo "# $0 $*" > ${fn}
+fi
+
+new=0
+for r in $*; do
+   case $r in
+        http*) url=$r ;;
+        *) url=${vcurl}${r} ;;
+   esac
+   if ! grep -q "^${url}" ${fn}; then
+       echo "${url}"
+       new=1
+   fi
+done >> ${fn}
+
+[ $new -eq 0 ] || echo >> ${fn}
+
+prev=/dev/null
+for r in $*; do
+    echo "+ fetching ${r}"
+    this=`mktemp /tmp/pullrevXXXXXX`
+    case $r in
+        http*) curl -s "$r" | filterdiff --strip=3 ;;
+        *) svn diff -c ${r} ${repo}  ;;
+    esac | filterdiff --remove-timestamps --clean \
+                      -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' \
+                      --addprefix="${prefix}/" > ${this}
+    next=`mktemp /tmp/pullrevXXXXXX`
+    if ! combinediff -w ${prev} ${this} > ${next}; then
+        echo "Failed combining previous ${prev} with ${this}";
+        exit 1
+    fi
+    rm -f "${this}"
+    [ "${prev}" = "/dev/null" ] || rm -f "${prev}"
+    prev=${next}
+done
+
+cat ${prev} >> ${fn}
+
+vi "${fn}"
+echo "+ git add ${fn}" 
+git add "${fn}"
+echo "+ spec template:"
+echo "PatchN: ${fn}"
+echo "%patchN -p1 -b .${suffix}"
--- a/server-status.conf
+++ b/server-status.conf
@ -0,0 +1,10 @@
+#
+# Lua-based server-status page; requires mod_lua to be loaded
+# as per default configuration.
+#
+LuaMapHandler ^/server-status$ /usr/share/httpd/server-status/server-status.lua
+
+<Directory /usr/share/httpd/server-status>
+    AllowOverride None
+    Require local
+</Directory>
--- a/3
+++ b/3
@ -0,0 +1,3 @@
+SHA512 (httpd-2.4.46.tar.bz2) = 5936784bb662e9d8a4f7fe38b70c043b468114d931cd10ea831bfe74461ea5856b64f88f42c567ab791fc8907640a99884ba4b6a600f86d661781812735b6f13
+SHA512 (httpd-2.4.46.tar.bz2.asc) = 1f54c20d1aeedb7c745eb72acd79e1ed61d547b22c3dbe53cd3274ed3d897543cd8c49181d4b15d79c12755746cf0a2464d620f69e254ac3f998760133094df0
+SHA512 (KEYS) = b776ca20863f8d9e4f66e8b56cbe020de34af5b268e93776d482392171f0e0aeee4f8d74477d128dc9fd24b30bbe33b39439964f1bd22a99782f1e4a08c85056
--- a/ssl.conf
+++ b/ssl.conf
@ -0,0 +1,219 @@
+#
+# When we also provide SSL we have to listen to the 
+# standard HTTPS port in addition.
+#
+Listen 443 https
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is a internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First the mechanism 
+#   to use and second the expiring timeout (in seconds).
+SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
+SSLSessionCacheTimeout  300
+
+#   Pseudo Random Number Generator (PRNG):
+#   Configure one or more sources to seed the PRNG of the 
+#   SSL library. The seed data should be of good random quality.
+#   WARNING! On some platforms /dev/random blocks if not enough entropy
+#   is available. This means you then cannot use the /dev/random device
+#   because it would lead to very long connection times (as long as
+#   it requires to make more entropy available). But usually those
+#   platforms additionally provide a /dev/urandom device which doesn't
+#   block. So, if available, use this one instead. Read the mod_ssl User
+#   Manual for more details.
+SSLRandomSeed startup file:/dev/urandom  256
+SSLRandomSeed connect builtin
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+
+#
+# Use "SSLCryptoDevice" to enable any supported hardware
+# accelerators. Use "openssl engine -v" to list supported
+# engine names.  NOTE: If you enable an accelerator and the
+# server does not start, consult the error logs and ensure
+# your accelerator is functioning properly. 
+#
+SSLCryptoDevice builtin
+#SSLCryptoDevice ubsec
+
+##
+## SSL Virtual Host Context
+##
+
+<VirtualHost _default_:443>
+
+# General setup for the virtual host, inherited from global configuration
+#DocumentRoot "/var/www/html"
+#ServerName www.example.com:443
+
+# Use separate log files for the SSL virtual host; note that LogLevel
+# is not inherited from httpd.conf.
+ErrorLog logs/ssl_error_log
+TransferLog logs/ssl_access_log
+LogLevel warn
+
+#   SSL Engine Switch:
+#   Enable/Disable SSL for this virtual host.
+SSLEngine on
+
+#   List the protocol versions which clients are allowed to connect with.
+#   The OpenSSL system profile is configured by default.  See
+#   update-crypto-policies(8) for more details.
+#SSLProtocol all -SSLv3
+#SSLProxyProtocol all -SSLv3
+
+#   User agents such as web browsers are not configured for the user's
+#   own preference of either security or performance, therefore this
+#   must be the prerogative of the web server administrator who manages
+#   cpu load versus confidentiality, so enforce the server's cipher order.
+SSLHonorCipherOrder on
+
+#   SSL Cipher Suite:
+#   List the ciphers that the client is permitted to negotiate.
+#   See the mod_ssl documentation for a complete list.
+#   The OpenSSL system profile is configured by default.  See
+#   update-crypto-policies(8) for more details.
+SSLCipherSuite PROFILE=SYSTEM
+SSLProxyCipherSuite PROFILE=SYSTEM
+
+#   Point SSLCertificateFile at a PEM encoded certificate.  If
+#   the certificate is encrypted, then you will be prompted for a
+#   pass phrase.  Note that restarting httpd will prompt again.  Keep
+#   in mind that if you have both an RSA and a DSA certificate you
+#   can configure both in parallel (to also allow the use of DSA
+#   ciphers, etc.)
+#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
+#   require an ECC certificate which can also be configured in
+#   parallel.
+SSLCertificateFile /etc/pki/tls/certs/localhost.crt
+
+#   Server Private Key:
+#   If the key is not combined with the certificate, use this
+#   directive to point at the key file.  Keep in mind that if
+#   you've both a RSA and a DSA private key you can configure
+#   both in parallel (to also allow the use of DSA ciphers, etc.)
+#   ECC keys, when in use, can also be configured in parallel
+SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
+
+#   Server Certificate Chain:
+#   Point SSLCertificateChainFile at a file containing the
+#   concatenation of PEM encoded CA certificates which form the
+#   certificate chain for the server certificate. Alternatively
+#   the referenced file can be the same as SSLCertificateFile
+#   when the CA certificates are directly appended to the server
+#   certificate for convenience.
+#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
+
+#   Certificate Authority (CA):
+#   Set the CA certificate verification path where to find CA
+#   certificates for client authentication or alternatively one
+#   huge file containing all of them (file must be PEM encoded)
+#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
+
+#   Client Authentication (Type):
+#   Client certificate verification type and depth.  Types are
+#   none, optional, require and optional_no_ca.  Depth is a
+#   number which specifies how deeply to verify the certificate
+#   issuer chain before deciding the certificate is not valid.
+#SSLVerifyClient require
+#SSLVerifyDepth  10
+
+#   Access Control:
+#   With SSLRequire you can do per-directory access control based
+#   on arbitrary complex boolean expressions containing server
+#   variable checks and other lookup directives.  The syntax is a
+#   mixture between C and Perl.  See the mod_ssl documentation
+#   for more details.
+#<Location />
+#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
+#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
+#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+#</Location>
+
+#   SSL Engine Options:
+#   Set various options for the SSL engine.
+#   o FakeBasicAuth:
+#     Translate the client X.509 into a Basic Authorisation.  This means that
+#     the standard Auth/DBMAuth methods can be used for access control.  The
+#     user name is the `one line' version of the client's X.509 certificate.
+#     Note that no password is obtained from the user. Every entry in the user
+#     file needs this password: `xxj31ZMTZzkVA'.
+#   o ExportCertData:
+#     This exports two additional environment variables: SSL_CLIENT_CERT and
+#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+#     server (always existing) and the client (only existing when client
+#     authentication is used). This can be used to import the certificates
+#     into CGI scripts.
+#   o StdEnvVars:
+#     This exports the standard SSL/TLS related `SSL_*' environment variables.
+#     Per default this exportation is switched off for performance reasons,
+#     because the extraction step is an expensive operation and is usually
+#     useless for serving static content. So one usually enables the
+#     exportation for CGI and SSI requests only.
+#   o StrictRequire:
+#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
+#     under a "Satisfy any" situation, i.e. when it applies access is denied
+#     and no other module can change it.
+#   o OptRenegotiate:
+#     This enables optimized SSL connection renegotiation handling when SSL
+#     directives are used in per-directory context. 
+#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+<FilesMatch "\.(cgi|shtml|phtml|php)$">
+    SSLOptions +StdEnvVars
+</FilesMatch>
+<Directory "/var/www/cgi-bin">
+    SSLOptions +StdEnvVars
+</Directory>
+
+#   SSL Protocol Adjustments:
+#   The safe and default but still SSL/TLS standard compliant shutdown
+#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+#   the close notify alert from client. When you need a different shutdown
+#   approach you can use one of the following variables:
+#   o ssl-unclean-shutdown:
+#     This forces an unclean shutdown when the connection is closed, i.e. no
+#     SSL close notify alert is sent or allowed to be received.  This violates
+#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
+#     this when you receive I/O errors because of the standard approach where
+#     mod_ssl sends the close notify alert.
+#   o ssl-accurate-shutdown:
+#     This forces an accurate shutdown when the connection is closed, i.e. a
+#     SSL close notify alert is sent and mod_ssl waits for the close notify
+#     alert of the client. This is 100% SSL/TLS standard compliant, but in
+#     practice often causes hanging connections with brain-dead browsers. Use
+#     this only for browsers where you know that their SSL implementation
+#     works correctly. 
+#   Notice: Most problems of broken clients are also related to the HTTP
+#   keep-alive facility, so you usually additionally want to disable
+#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+#   "force-response-1.0" for this.
+BrowserMatch "MSIE [2-5]" \
+         nokeepalive ssl-unclean-shutdown \
+         downgrade-1.0 force-response-1.0
+
+#   Per-Server Logging:
+#   The home of a custom SSL log file. Use this when you want a
+#   compact non-error SSL logfile on a virtual host basis.
+CustomLog logs/ssl_request_log \
+          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
+
+</VirtualHost>
+
--- a/tests/httpd-php-mysql-sanity-test/Makefile
+++ b/tests/httpd-php-mysql-sanity-test/Makefile
@ -0,0 +1,67 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+#   Description: test fetching data from mysqldb/mariadb through php
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE new_mysql.php old_mysql.php php_mysql_test.sql php_mysql_test.conf
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+-include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Karel Srot <ksrot@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     test fetching data from mysqldb/mariadb through php" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          httpd" >> $(METADATA)
+	@echo "Requires:        httpd php php-zts php-mysqlnd mysql-server mariadb-server" >> $(METADATA)
+	@echo "RhtsRequires:    library(httpd/http)" >> $(METADATA)
+	@echo "RhtsRequires:    library(mysql/basic)" >> $(METADATA)
+	@echo "RhtsRequires:    library(mariadb55/basic)" >> $(METADATA)
+	@echo "RhtsRequires:    library(php/utils)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+
+	rhts-lint $(METADATA)
--- a/tests/httpd-php-mysql-sanity-test/PURPOSE
+++ b/tests/httpd-php-mysql-sanity-test/PURPOSE
@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+Description: test fetching data from mysqldb/mariadb through php
+Author: Karel Srot <ksrot@redhat.com>
--- a/tests/httpd-php-mysql-sanity-test/new_mysql.php
+++ b/tests/httpd-php-mysql-sanity-test/new_mysql.php
@ -0,0 +1,12 @@
+<?php
+$db = mysqli_connect("localhost", "root");
+if (!$db) {
+    die("Could not connect");
+}
+if (!mysqli_select_db($db, "php_mysql_test")) {
+    die("Could not select database");
+}
+$res = mysqli_query($db, "SELECT * from foobar");
+$row = mysqli_fetch_assoc($res);
+printf("%s is %d\n", $row['name'], $row['value']);
+?>
--- a/tests/httpd-php-mysql-sanity-test/old_mysql.php
+++ b/tests/httpd-php-mysql-sanity-test/old_mysql.php
@ -0,0 +1,12 @@
+<?php
+$db = mysql_connect("localhost", "root");
+if (!$db) {
+    die("Could not connect");
+}
+if (!mysql_select_db("php_mysql_test")) {
+    die("Could not select database");
+}
+$res = mysql_query("SELECT * from foobar");
+$row = mysql_fetch_assoc($res);
+printf("%s is %d\n", $row['name'], $row['value']);
+?>
--- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
+++ b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
@ -0,0 +1,5 @@
+
+Alias /php_mysql_test /var/www/php_mysql_test
+
+<Directory /var/www/php_mysql_test>
+</Directory>
--- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
+++ b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
@ -0,0 +1,6 @@
+
+CREATE DATABASE php_mysql_test;
+USE php_mysql_test;
+
+CREATE TABLE foobar (name VARCHAR(10), value INTEGER);
+INSERT INTO foobar VALUES("fish", 42);
--- a/tests/httpd-php-mysql-sanity-test/runtest.sh
+++ b/tests/httpd-php-mysql-sanity-test/runtest.sh
@ -0,0 +1,102 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+#   Description: test fetching data from mysqldb/mariadb through php
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+[ -e /usr/bin/rhts-environment.sh ] && . /usr/bin/rhts-environment.sh
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES="${PACKAGES:-httpd}"
+REQUIRES="${REQUIRES:-php $DB}"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport httpd/http" 0 "Import httpd library"
+        if rlIsRHEL 5 6 && [ $httpCOLLECTION = 0 ]; then
+            DB="mysql-server"
+            rlRun "rlImport mysql/basic" 0 "Import mysqld library"
+            SERVICE=${mysqlServiceName}
+        else
+            DB="mariadb-server"
+            rlRun "rlImport mariadb55/basic" 0 "Import mariadb library"
+            SERVICE=${mariadbServiceName}
+        fi
+	# install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7)
+        rlRun "rlImport php/utils"
+        phpPdoPhpMysqlSetup
+        rlAssertRpm --all
+        rlRun "rlServiceStart $SERVICE" 0
+        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" 0,1
+        rlRun "mysql --verbose -u root < php_mysql_test.sql"
+        rlRun "httpStop" 0 "Stop httpd if running"
+        rlRun "> $httpLOGDIR/error_log"
+        rlRun "rm -rvf $httpROOTDIR/php_mysql_test"
+        rlRun "mkdir -v $httpROOTDIR/php_mysql_test"
+        rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/"
+        php_version=`rlCheckRpm php`
+        if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then
+            rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
+        else
+            rlRun "cp -v old_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
+        fi
+        rlRun "sed -i 's|/var/www|$httpROOTDIR|' $httpCONFDIR/conf.d/php_mysql_test.conf"
+        rlRun "chown -R apache:  $httpROOTDIR/php_mysql_test"
+        #rlRun "restorecon  $httpROOTDIR/php_mysql_test"
+        selinuxenabled && rlRun "chcon -Rv -t httpd_sys_content_t $httpROOTDIR/php_mysql_test"
+        rlRun "httpStart" 0 "Start httpd"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        URL="http://localhost/php_mysql_test/"
+        RETVAL=0
+        tries=`seq 1 10`
+
+        for n in ${tries}; do
+            output=`curl -s $URL/mysql.php`
+            rv=$?
+            echo "PHP output ${n}: ${rv} x${output}y"
+            [ ${rv} -ne 0 -o "x${output}y" != "xfish is 42y" ] && RETVAL=66
+        done
+
+        if [ $RETVAL -ne 0 ]; then
+            rlFail
+        else
+            rlPass
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $httpCONFDIR/conf.d/php_mysql_test.conf"
+        rlRun "rm -rf $httpROOTDIR/php_mysql_test"
+        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root"
+        rlRun "rlServiceRestore ${SERVICE}" 0
+        rlRun "httpStop" 0 "Stop httpd if running"
+	# uninstall php-mysql on rhel-6 if it was installed during setup
+        phpPdoPhpMysqlCleanup
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,12 @@
+---
+# Tests that run in all contexts
+- hosts: localhost
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    tests:
+    - httpd-php-mysql-sanity-test
+    required_packages:
+    - findutils         # beakerlib needs find command
+    - which             # smoke requires which command
--- a/1
+++ b/1
@ -0,0 +1 @@
+httpd-2.2.16.tar.gz
--- a/upstream-key.gpg
+++ b/upstream-key.gpg
--- a/userdir.conf
+++ b/userdir.conf
@ -0,0 +1,36 @@
+#
+# UserDir: The name of the directory that is appended onto a user's home
+# directory if a ~user request is received.
+#
+# The path to the end user account 'public_html' directory must be
+# accessible to the webserver userid.  This usually means that ~userid
+# must have permissions of 711, ~userid/public_html must have permissions
+# of 755, and documents contained therein must be world-readable.
+# Otherwise, the client will only receive a "403 Forbidden" message.
+#
+<IfModule mod_userdir.c>
+    #
+    # UserDir is disabled by default since it can confirm the presence
+    # of a username on the system (depending on home directory
+    # permissions).
+    #
+    UserDir disabled
+
+    #
+    # To enable requests to /~user/ to serve the user's public_html
+    # directory, remove the "UserDir disabled" line above, and uncomment
+    # the following line instead:
+    # 
+    #UserDir public_html
+</IfModule>
+
+#
+# Control access to UserDir directories.  The following is an example
+# for a site where these directories are restricted to read-only.
+#
+<Directory "/home/*/public_html">
+    AllowOverride FileInfo AuthConfig Limit Indexes
+    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+    Require method GET POST OPTIONS
+</Directory>
+
--- a/welcome.conf
+++ b/welcome.conf
@ -0,0 +1,19 @@
+# 
+# This configuration file enables the default "Welcome" page if there
+# is no default index page present for the root URL.  To disable the
+# Welcome page, comment out all the lines below. 
+#
+# NOTE: if this file is removed, it will be restored on upgrades.
+#
+<LocationMatch "^/+$">
+    Options -Indexes
+    ErrorDocument 403 /.noindex.html
+</LocationMatch>
+
+<Directory /usr/share/httpd/noindex>
+    AllowOverride None
+    Require all granted
+</Directory>
+
+Alias /.noindex.html /usr/share/httpd/noindex/index.html
+Alias /poweredby.png /usr/share/httpd/icons/apache_pb2.png