Multiple websites on one server

Architecture

Two names can resolve to the same public IP. HTTP Host and TLS SNI let the server choose the right site. This is not strong tenant isolation: both applications still share host resources unless you add process/container/account boundaries. A compromised writable application must not be able to overwrite another site's code.

Prepare roots

sudo mkdir -p /var/www/site-a /var/www/site-b
printf '<h1>Site A</h1>' | sudo tee /var/www/site-a/index.html
printf '<h1>Site B</h1>' | sudo tee /var/www/site-b/index.html

Apache configuration

Save the two virtual hosts in an included file on AL2023, or separate Ubuntu site files enabled using a2ensite. Use distinct log filenames if you want per-site diagnosis.

<VirtualHost *:80>
    ServerName a.example.com
    DocumentRoot /var/www/site-a
    <Directory /var/www/site-a>
        Require all granted
        Options -Indexes
    </Directory>
</VirtualHost>
<VirtualHost *:80>
    ServerName b.example.com
    DocumentRoot /var/www/site-b
    <Directory /var/www/site-b>
        Require all granted
        Options -Indexes
    </Directory>
</VirtualHost>

Use sudo apachectl -S on AL2023 or sudo apache2ctl -S on Ubuntu to inspect matching and defaults. Test syntax then reload the correct service.

Nginx alternative

server {
    listen 80;
    server_name a.example.com;
    root /var/www/site-a;
    index index.html;
    location / { try_files $uri $uri/ =404; }
}
server {
    listen 80;
    server_name b.example.com;
    root /var/www/site-b;
    index index.html;
    location / { try_files $uri $uri/ =404; }
}

Save under conf.d on AL2023. On Ubuntu use conf.d if included, or sites-available plus a symlink into sites-enabled. Do not load the same file through both paths. Test with nginx -t and reload.

Verify all four combinations

curl -H 'Host: a.example.com' http://127.0.0.1/
curl -H 'Host: b.example.com' http://127.0.0.1/
curl -H 'Host: unknown.example.com' http://127.0.0.1/

Repeat on Apache/AL2023, Apache/Ubuntu, Nginx/AL2023 and Nginx/Ubuntu using separate lab instances or one server at a time. The unknown hostname reveals the default virtual host. Choose an intentional default instead of accidentally exposing a sensitive site.

DNS, HTTPS and PHP

Create both DNS records and issue a certificate covering the appropriate names or separate certificates. For PHP applications use per-site pools/users when isolation is required, document-root-scoped script mapping and separate writable directories. Keep secrets outside every public root.

Assignment

Deliberately swap one root, observe the wrong page, inspect active configuration and correct it. Explain why changing only DNS cannot repair an incorrect server_name or DocumentRoot.

Official reference

Apache name-based virtual hosts

Interview and revision check

Do separate virtual hosts provide strong tenant isolation?

Not by themselves. They share host resources and often service identities; use separate users/pools/containers or hosts as requirements demand.