Skip to main content
emisar

Apache HTTPD operations

v0.1.18

Apache version, modules, mod_status snapshot, config syntax check, vhost dump, error/access log tails, plus narrow mutators (graceful reload, graceful stop). Full restart not included — use systemd for that.

8 allowed by default 1 need approval by default 1 denied by default
Pack ID
apache-httpd
Vendor
emisar
OS
linux
Actions
10
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
apachectl curl

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install apache-httpd --hash sha256:aab3cc36cc14cfda7bc6a07e9069ea803ffb5815c76b9aaa6f8ef43391ca40dd

Setup

Operates on the local Apache instance on the runner host — no credentials needed. Defaults to the Debian/Ubuntu layout; override the paths below only if your install differs.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • HTTPD_STATUS_URL default http://127.0.0.1/server-status?auto

    mod_status URL the status action fetches (requires mod_status enabled).

  • HTTPD_ERROR_LOG default /var/log/apache2/error.log

    Path to the Apache error log for error_tail.

  • HTTPD_ACCESS_LOG default /var/log/apache2/access.log

    Path to the Apache access log for the access_top_* actions.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Read protected Apache configuration or signal the root-owned master process.

httpd.moduleshttpd.vhostshttpd.test_confighttpd.graceful_reloadhttpd.graceful_stop

Run the Emisar service as root

Grant access 
sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-apache-httpd-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar
Verify access 
test "$(systemctl show emisar --property=User --value)" = root

Impact: Every Emisar action on this runner executes as root. Apache actions can read private configuration and can stop or reload the web server.

Read Apache logs through the Debian or Ubuntu system log-reader group.

httpd.error_tailhttpd.access_top_clientshttpd.access_top_urls

Add the Emisar service user to adm

Grant access 
sudo usermod -aG adm emisar
sudo systemctl restart emisar
Verify access 
id -nG emisar | tr ' ' '\n' | grep -Fx adm
sudo -u emisar test -r /var/log/apache2/error.log

Impact: Every process running as emisar can read every host log granted to adm, not only Apache logs. RHEL-family paths need an equivalent persistent log-reader grant.

Notes

  • Any of HTTPD_STATUS_URL you set must also be allowlisted in the runner's execution.inherit_env — the action env is scrubbed to PATH/LANG/LC_ALL/TERM by default, so an env present on the host but not allowlisted is silently dropped (the action falls back to its local default or fails auth).
  • On RHEL-family installs the logs live under /var/log/httpd — set HTTPD_ERROR_LOG / HTTPD_ACCESS_LOG accordingly.

Verify it works

Runs httpd.version, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify apache-httpd

Install and configure a pack walks through the whole sequence on a host.

Actions 10 total

View on GitHub
  • httpd.access_top_clients exec low Low — read-only or trivially reversible

    Top client IPs from access log

    Show a tally of source IPs from the last N access log lines.

    View source on GitHub
  • httpd.access_top_urls exec low Low — read-only or trivially reversible

    Top URLs from access log

    Show a tally of request paths from the last N access log lines. The query string is stripped before the tally, so a one-shot credential in a password-reset, magic-link, or OAuth callback URL never leaves the host.

    View source on GitHub
  • httpd.error_tail exec medium Medium — changes state, easily reversible

    tail error_log

    Tail the last N lines from the Apache error log.

    View source on GitHub
  • httpd.graceful_reload exec high High — service-affecting

    apachectl graceful

    Re-read config and gracefully reload child workers — no dropped requests.

    View source on GitHub
  • httpd.graceful_stop exec critical Critical — data loss or irreversible

    apachectl graceful-stop

    Drain in-flight requests then shut down. Apache will NOT come back automatically; use systemd to restart.

    View source on GitHub
  • httpd.modules exec low Low — read-only or trivially reversible

    apachectl -M

    List all loaded modules (static + shared).

    View source on GitHub
  • httpd.status exec low Low — read-only or trivially reversible

    mod_status snapshot

    Show a snapshot of mod_status (requires mod_status enabled). Set HTTPD_STATUS_URL env var.

    View source on GitHub
  • httpd.test_config exec low Low — read-only or trivially reversible

    apachectl -t

    Check config syntax. Run before graceful_reload.

    View source on GitHub
  • httpd.version exec low Low — read-only or trivially reversible

    apachectl -V

    Show Apache version + compiled-in directives + MPM.

    View source on GitHub
  • httpd.vhosts exec low Low — read-only or trivially reversible

    apachectl -S

    List all configured vhosts with their effective listen + ServerName.

    View source on GitHub
← Back to registry
Pack reference  Publish your own