Ravindra BagaleCourses & study guides

8. Hosting a Static Website and Changing the Configuration

8.6 Changing the Document Root

By Last updated:

Samja website /var/www/portfolio madhun serve karaychi aahe. Nginx madhe root, Apache madhe DocumentRoot aani tyacha <Directory> – donhi badlayche.

# 1. create the folder and a test page
sudo mkdir -p /var/www/portfolio
echo '<h1>Portfolio served from /var/www/portfolio</h1>' | sudo tee /var/www/portfolio/index.html
sudo chmod 755 /var/www/portfolio
sudo chmod 644 /var/www/portfolio/index.html

Amazon Linux 2023 / CentOS Stream 9: create a site file (the built-in block inside nginx.conf still exists, so we check which block is the default):

sudo tee /etc/nginx/conf.d/portfolio.conf > /dev/null <<'__EOCONF__'
server {
    listen 80;
    listen [::]:80;
    server_name _;
    root /var/www/portfolio;
    index index.html;
    location / { try_files $uri $uri/ =404; }
}
__EOCONF__
grep -n "default_server" /etc/nginx/nginx.conf      # if found, remove "default_server" there
sudo nginx -t && sudo service nginx reload

Why grep for default_server?

In /etc/nginx/nginx.conf the line include /etc/nginx/conf.d/*.conf; comes before the built-in server { ... } block. So if no block says default_server, your conf.d block loads first and wins for unknown names. But some package versions mark the built-in block listen 80 default_server;, and then it wins instead. The fix is either to put your real domain or public IP in server_name (as in Chapter 8), or to move default_server to your own block.

Ubuntu: edit the site file and change one line:

sudo sed -i 's#root /var/www/html;#root /var/www/portfolio;#' /etc/nginx/sites-available/default
grep -n "root" /etc/nginx/sites-available/default
sudo nginx -t && sudo service nginx reload

CentOS Stream 9 only: SELinux. Folders under /var/www automatically get the correct httpd_sys_content_t label. For any other path, such as /srv/portfolio or /data/site, you must teach SELinux about it, or you'll get 403 Forbidden:

sudo yum install -y policycoreutils-python-utils           # provides semanage
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/portfolio(/.*)?"
sudo restorecon -Rv /srv/portfolio
ls -Z /srv/portfolio                                        # should show httpd_sys_content_t

Verify with curl -s http://localhost | head -3 and then from your browser.

Never point the root at /root or /home/ec2-user

The web server runs as nginx / www-data / apache, which can't read inside home folders (permissions 700/750). Changing folder permissions on your home to "fix" a 403 exposes your SSH keys and files. Keep websites under /var/www (or /srv) and copy files there.

Apache:

Option A: edit the virtual host (recommended). Change DocumentRoot and the matching <Directory> path together:

# Ubuntu: default site
sudo sed -i 's#/var/www/html#/var/www/portfolio#' /etc/apache2/sites-available/000-default.conf
sudo tee /etc/apache2/conf-available/portfolio-dir.conf > /dev/null <<'__EOCONF__'
<Directory /var/www/portfolio>
    Options -Indexes +FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>
__EOCONF__
sudo a2enconf portfolio-dir
sudo apache2ctl configtest && sudo service apache2 reload

# Amazon Linux 2023 / CentOS Stream 9: own virtual host
sudo tee /etc/httpd/conf.d/portfolio.conf > /dev/null <<'__EOCONF__'
<VirtualHost *:80>
    ServerName portfolio.local
    DocumentRoot /var/www/portfolio
    <Directory /var/www/portfolio>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
__EOCONF__
sudo apachectl configtest && sudo service httpd reload

Option B: change the global default in /etc/httpd/conf/httpd.conf, which has both DocumentRoot "/var/www/html" and <Directory "/var/www/html">. Change both, then test and reload. It works, but Option A is cleaner.

Ubuntu security default

/etc/apache2/apache2.conf denies access to / and allows only /var/www and /usr/share. A DocumentRoot outside these (e.g. /srv/site) needs its own <Directory> block with Require all granted. Otherwise you get 403 Forbidden even with perfect file permissions.

Ravindra Bagale's Tip

When I get a 403, I ask three questions: Does the file exist, and is the whole path 755/644 (namei -l /var/www/portfolio/index.html)? Is root/<Directory> exactly this path? Is the SELinux label correct (ls -Z)? Many students only change permissions – check all three.

Lab

Move your site to /var/www/portfolio on both web servers. Then try /srv/portfolio and observe what extra steps are needed.