httpd.conf

# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# Do not add a slash at the end of the directory path.  If you point
# ServerRoot at a non-local disk, be sure to specify a local disk on the
# Mutex directive, if file-based mutexes are used.  If you wish to share the
# same ServerRoot for multiple httpd daemons, you will need to change at
# least PidFile.
#
ServerRoot "${SNAP}"

#
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, instead of the default. See also the <VirtualHost>
# directive.
#
# Change this to Listen on specific IP addresses as shown below to 
# prevent Apache from glomming onto all bound IP addresses.
#
#Listen 12.34.56.78:80
Listen 80

#
# Mutex: Allows you to set the mutex mechanism and mutex file directory
# for individual mutexes, or change the global defaults
#
# Using pthread here, since Apache tries to chown the file-based mutex
# which isn't allowed in Snappy, and Ubuntu supports robust pthread
# mutexes that can be recovered if the child process terminates
# abnormally.
#
Mutex pthread

#
# PidFile: Allows you to place the pidfile in a specific location.
PidFile "${SNAP_DATA}/apache/httpd.pid"

#
# Dynamic Shared Object (DSO) Support
#
# To be able to use the functionality of a module which was built as a DSO you
# have to place corresponding `LoadModule' lines at this location so the
# directives contained in it are actually available _before_ they are used.
# Statically compiled modules (those listed by `httpd -l') do not need
# to be loaded here.
#
# Example:
# LoadModule foo_module modules/mod_foo.so
#
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule mime_module modules/mod_mime.so
LoadModule env_module modules/mod_env.so
LoadModule headers_module modules/mod_headers.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
LoadModule log_config_module modules/mod_log_config.so

# 'Main' server configuration
#
# The directives in this section set up the values used by the 'main'
# server, which responds to any requests that aren't handled by a
# <VirtualHost> definition.  These values also provide defaults for
# any <VirtualHost> containers you may define later in the file.
#
# All of these directives may appear inside <VirtualHost> containers,
# in which case these default settings will be overridden for the
# virtual host being defined.
#

#
# Deny access to the entirety of your server's filesystem. You must
# explicitly permit access to web content directories in other 
# <Directory> blocks below.
#
<Directory />
    AllowOverride none
    Require all denied
</Directory>

#
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.
#

#
# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.
#
DocumentRoot "${SNAP}/htdocs"
<Directory "${SNAP}/htdocs">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.4/mod/core.html#options
    # for more information.
    #
    Options FollowSymLinks

    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   AllowOverride FileInfo AuthConfig Limit
    #
    AllowOverride None

    #
    # Controls who can get stuff from this server.
    #
    Require all granted
</Directory>

# Serve static assets for apps in a writable location.
Alias "/extra-apps" "${SNAP_DATA}/nextcloud/extra-apps"
<Directory "${SNAP_DATA}/nextcloud/extra-apps">
    AllowOverride None
    Require all granted
</Directory>

# Serve ACME authentication data (Let's Encrypt).
Alias "/.well-known" "${SNAP_DATA}/certs/certbot/.well-known"
<Directory "${SNAP_DATA}/certs/certbot/.well-known">
    AllowOverride None
    Require all granted
</Directory>

#
# The following lines prevent .htaccess and .htpasswd files from being 
# viewed by Web clients. 
#
<Files ".ht*">
    Require all denied
</Files>

# Setup the proxy to PHP-FPM
ProxyTimeout 3600
<FilesMatch \.php$>
    SetHandler "proxy:unix:${SNAP_DATA}/php/php-fpm.sock|fcgi://localhost/"
</FilesMatch>

<Proxy "fcgi://localhost/">
</Proxy>

#
# Default log location. If you define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog "${SNAP_DATA}/apache/logs/error_log"

#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel warn

#
# TypesConfig points to the file containing the list of mappings from
# filename extension to MIME-type.
#
TypesConfig conf/mime.types

# Only enable SSL if requested
<IfDefine EnableHTTPS>
    Include ${SNAP}/conf/ssl.conf
</IfDefine>
<IfDefine !EnableHTTPS>
    # In this case, we're HTTP only.
    <VirtualHost *:80>
        # Include Nextcloud's .htaccess file directly. In a typical setup this would
        # be dangerous since it increases the capability of the .htaccess file in
        # case an attacker was able to modify it, but that's not actually possible
        # on Snappy (since the .htaccess file is read-only) so we'll do it here so
        # as to avoid manually copying it in and needing to maintain it.
        Include ${SNAP}/htdocs/.htaccess
    </VirtualHost>
</IfDefine>

# Override our settings with a user-defined configuration
Include ${SNAP_DATA}/apache/conf/custom.conf