git subrepo clone https://leap.se/git/puppet_apache puppet/modules/apache

subrepo:
  subdir:   "puppet/modules/apache"
  merged:   "415e950"
upstream:
  origin:   "https://leap.se/git/puppet_apache"
  branch:   "master"
  commit:   "415e950"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Iba7353669969a09c0b4bbd63add67e3245b05ede

27 files changed, 2929 insertions, 0 deletions

diff --git a/puppet/modules/apache/manifests/vhost/davdbdir.pp b/puppet/modules/apache/manifests/vhost/davdbdir.pp
new file mode 100644
index 00000000..459167c9
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/davdbdir.pp
@@ -0,0 +1,40 @@
+define apache::vhost::davdbdir(
+    $ensure = present,
+    $dav_db_dir = 'absent',
+    $documentroot_owner = apache,
+    $documentroot_group = 0,
+    $documentroot_mode = 0750,
+    $run_mode = 'normal',
+    $run_uid = 'absent'
+){
+    # php db dir
+    case $dav_db_dir {
+        'absent': {
+            include apache::defaultdavdbdir
+            $real_dav_db_dir = "/var/www/dav_db_dir/${name}"
+        }
+        default: { $real_dav_db_dir = $dav_db_dir }
+    }
+
+    case $ensure {
+        absent: {
+            file{$real_dav_db_dir:
+                ensure => absent,
+                purge => true,
+                force => true,
+                recurse => true,
+            }
+        }
+        default: {
+            file{$real_dav_db_dir:
+                ensure => directory,
+                owner => $run_mode ? {
+                    'itk' => $run_uid,
+                    default => $documentroot_owner
+                },
+                group => $documentroot_group, mode => $documentroot_mode;
+            }
+        }
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/file.pp b/puppet/modules/apache/manifests/vhost/file.pp
new file mode 100644
index 00000000..686cb1a1
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/file.pp
@@ -0,0 +1,151 @@
+# htpasswd_file: wether to deploy a passwd for this vhost or not
+#   - absent: ignore (default)
+#   - nodeploy: htpasswd file isn't deployed by this mechanism
+#   - else: try to deploy the file
+#
+# htpasswd_path: where to deploy the passwd file
+#   - absent: standardpath (default)
+#   - else: path to deploy
+#
+# ssl_mode: wether this vhost supports ssl or not
+#   - false: don't enable ssl for this vhost (default)
+#   - true: enable ssl for this vhost
+#   - force: enable ssl and redirect non-ssl to ssl
+#   - only: enable ssl only
+#
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+#
+# mod_security: Whether we use mod_security or not
+#               (will include mod_security module)
+#    - false: (*default*) don't activate mod_security
+#    - true: activate mod_security
+#
+define apache::vhost::file(
+    $ensure             = present,
+    $configuration      = {},
+    $vhost_source       = 'absent',
+    $vhost_destination  = 'absent',
+    $content            = 'absent',
+    $do_includes        = false,
+    $run_mode           = 'normal',
+    $logmode            = 'default',
+    $ssl_mode           = false,
+    $mod_security       = false,
+    $htpasswd_file      = 'absent',
+    $htpasswd_path      = 'absent',
+    $use_mod_macro      = false
+){
+    $vhosts_dir = $::operatingsystem ? {
+        centos  => "${apache::centos::config_dir}/vhosts.d",
+        gentoo  => "${apache::gentoo::config_dir}/vhosts.d",
+        debian  => "${apache::debian::config_dir}/sites-enabled",
+        ubuntu  => "${apache::ubuntu::config_dir}/sites-enabled",
+        openbsd => "${apache::openbsd::config_dir}/vhosts.d",
+        default => '/etc/apache2/vhosts.d',
+    }
+    $real_vhost_destination = $vhost_destination ? {
+        'absent'  => "${vhosts_dir}/${name}.conf",
+        default   => $vhost_destination,
+    }
+    file{"${name}.conf":
+        ensure  => $ensure,
+        path    => $real_vhost_destination,
+        require => File[vhosts_dir],
+        notify  => Service[apache],
+        owner   => root,
+        group   => 0,
+        mode    => '0644';
+    }
+    if $ensure != 'absent' {
+      if $do_includes {
+        include ::apache::includes
+      }
+      if $use_mod_macro {
+        include ::apache::mod_macro
+      }
+      case $logmode {
+        'semianonym','anonym': { include apache::noiplog }
+      }
+      case $run_mode {
+        'itk': {
+          include ::apache::itk::lock
+          if $mod_security { include mod_security::itk }
+        }
+        'proxy-itk','static-itk': {
+          include ::apache::itk_plus::lock
+          if $mod_security { include mod_security::itk_plus }
+        }
+        default: {
+          if $mod_security { include mod_security }
+        }
+      }
+
+      case $content {
+        'absent': {
+            $real_vhost_source = $vhost_source ? {
+                'absent'  => [
+                    "puppet:///modules/site_apache/vhosts.d/${::fqdn}/${name}.conf",
+                    "puppet:///modules/site_apache/vhosts.d/${apache::cluster_node}/${name}.conf",
+                    "puppet:///modules/site_apache/vhosts.d/${::operatingsystem}.${::operatingsystemmajrelease}/${name}.conf",
+                    "puppet:///modules/site_apache/vhosts.d/${::operatingsystem}/${name}.conf",
+                    "puppet:///modules/site_apache/vhosts.d/${name}.conf",
+                    "puppet:///modules/apache/vhosts.d/${::operatingsystem}.${::operatingsystemmajrelease}/${name}.conf",
+                    "puppet:///modules/apache/vhosts.d/${::operatingsystem}/${name}.conf",
+                    "puppet:///modules/apache/vhosts.d/${name}.conf"
+                ],
+                default => "puppet:///${vhost_source}",
+            }
+            File["${name}.conf"]{
+                source => $real_vhost_source,
+            }
+        }
+        default: {
+            File["${name}.conf"]{
+                content => $content,
+            }
+        }
+      }
+    }
+    case $htpasswd_file {
+        'absent','nodeploy': { info("don't deploy a htpasswd file for ${name}") }
+        default: {
+            if $htpasswd_path == 'absent' {
+                $real_htpasswd_path = "/var/www/htpasswds/${name}"
+            } else {
+                $real_htpasswd_path = $htpasswd_path
+            }
+            file{$real_htpasswd_path:
+                ensure => $ensure,
+            }
+            if ($ensure!='absent') {
+              File[$real_htpasswd_path]{
+                source  => [ "puppet:///modules/site_apache/htpasswds/${::fqdn}/${name}",
+                            "puppet:///modules/site_apache/htpasswds/${apache::cluster_node}/${name}",
+                            "puppet:///modules/site_apache/htpasswds/${name}" ],
+                owner   => root,
+                group   => 0,
+                mode    => '0644',
+              }
+            }
+        }
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/file/documentrootdir.pp b/puppet/modules/apache/manifests/vhost/file/documentrootdir.pp
new file mode 100644
index 00000000..425406ad
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/file/documentrootdir.pp
@@ -0,0 +1,24 @@
+define apache::vhost::file::documentrootdir(
+      $ensure = directory,
+      $documentroot,
+      $filename,
+      $thedomain,
+      $owner = 'root',
+      $group = '0',
+      $mode = 440
+){
+  file{"$documentroot/$filename":
+    require => Apache::Vhost::Webdir["$thedomain"],
+    owner => $owner, group => $group, mode => $mode;
+  }
+  if $ensure != 'absent' {
+    File["$documentroot/$filename"]{
+      ensure => directory,
+    }
+  } else {
+    File["$documentroot/$filename"]{
+      ensure => $ensure,
+    }
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/file/documentrootfile.pp b/puppet/modules/apache/manifests/vhost/file/documentrootfile.pp
new file mode 100644
index 00000000..c5bc72a1
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/file/documentrootfile.pp
@@ -0,0 +1,27 @@
+# place a file in the documentroot
+define apache::vhost::file::documentrootfile(
+  $documentroot,
+  $filename,
+  $thedomain,
+  $owner        = 'root',
+  $group        = '0',
+  $mode         = '0440',
+){
+    file{"${documentroot}/${filename}":
+        source  => [ "puppet:///modules/site_apache/vhost_varieties/${::fqdn}/${thedomain}/${filename}",
+                    "puppet:///modules/site_apache/vhost_varieties/${apache::cluster_node}/${thedomain}/${filename}",
+                    "puppet:///modules/site_apache/vhost_varieties/${::operatingsystem}.${::operatingsystemmajrelease}/${thedomain}/${filename}",
+                    "puppet:///modules/site_apache/vhost_varieties/${::operatingsystem}/${thedomain}/${filename}",
+                    "puppet:///modules/site_apache/vhost_varieties/${thedomain}/${filename}",
+                    "puppet:///modules/apache/vhost_varieties/${thedomain}/${filename}",
+                    "puppet:///modules/apache/vhost_varieties/${::operatingsystem}.${::operatingsystemmajrelease}/${thedomain}/${filename}",
+                    "puppet:///modules/apache/vhost_varieties/${::operatingsystem}/${thedomain}/${filename}",
+                    "puppet:///modules/apache/vhost_varieties/${thedomain}/${filename}",
+        ],
+        require => Apache::Vhost::Webdir[$thedomain],
+        owner   => $owner,
+        group   => $group,
+        mode    => $mode;
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/gitweb.pp b/puppet/modules/apache/manifests/vhost/gitweb.pp
new file mode 100644
index 00000000..6dd86439
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/gitweb.pp
@@ -0,0 +1,59 @@
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::gitweb(
+    $ensure = present,
+    $configuration = {},
+    $domain = 'absent',
+    $logmode = 'default',
+    $domainalias = 'absent',
+    $server_admin = 'absent',
+    $owner = root,
+    $group = apache,
+    $documentroot_owner = apache,
+    $documentroot_group = 0,
+    $documentroot_mode = 0640,
+    $allow_override = 'None',
+    $template_partial = 'apache/vhosts/gitweb/partial.erb',
+    $do_includes = false,
+    $options = 'absent',
+    $additional_options = 'absent',
+    $default_charset = 'absent',
+    $ssl_mode = false,
+    $htpasswd_file = 'absent',
+    $htpasswd_path = 'absent'
+){
+    # create vhost configuration file
+    ::apache::vhost{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        path => '/var/www/git',
+        path_is_webdir => true,
+        logpath => $::operatingsystem ? {
+            centos => '/var/log/httpd',
+            fedora => '/var/log/httpd',
+            redhat => '/var/log/httpd',
+            openbsd => '/var/www/logs',
+            default => '/var/log/apache2'
+        },
+        logmode => $logmode,
+        template_partial => $template_partial,
+        domain => $domain,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        allow_override => $allow_override,
+        do_includes => $do_includes,
+        options => $options,
+        additional_options => $additional_options,
+        default_charset => $default_charset,
+        run_mode => 'normal',
+        ssl_mode => $ssl_mode,
+        htpasswd_file => $htpasswd_file,
+        htpasswd_path => $htpasswd_path,
+        mod_security => false,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/modperl.pp b/puppet/modules/apache/manifests/vhost/modperl.pp
new file mode 100644
index 00000000..31e46b6f
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/modperl.pp
@@ -0,0 +1,153 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::modperl(
+    $ensure = present,
+    $configuration = configuration,
+    $domain = 'absent',
+    $domainalias = 'absent',
+    $server_admin = 'absent',
+    $logmode = 'default',
+    $path = 'absent',
+    $owner = root,
+    $group = apache,
+    $documentroot_owner = apache,
+    $documentroot_group = 0,
+    $documentroot_mode = 0640,
+    $run_mode = 'normal',
+    $run_uid = 'absent',
+    $run_gid = 'absent',
+    $allow_override = 'None',
+    $cgi_binpath = 'absent',
+    $do_includes = false,
+    $options = 'absent',
+    $additional_options = 'absent',
+    $default_charset = 'absent',
+    $mod_security = true,
+    $mod_security_relevantonly = true,
+    $mod_security_rules_to_disable = [],
+    $mod_security_additional_options = 'absent',
+    $ssl_mode = false,
+    $vhost_mode = 'template',
+    $template_partial = 'apache/vhosts/perl/partial.erb',
+    $vhost_source = 'absent',
+    $vhost_destination = 'absent',
+    $htpasswd_file = 'absent',
+    $htpasswd_path = 'absent'
+){
+    # cgi_bin path
+    case $cgi_binpath {
+        'absent': {
+            $real_path = $path ? {
+                'absent' => $::operatingsystem ? {
+                    openbsd => "/var/www/htdocs/${name}",
+                    default => "/var/www/vhosts/${name}"
+                },
+                default => $path
+            }
+            $real_cgi_binpath = "${real_path}/cgi-bin"
+        }
+        default: { $real_cgi_binpath = $cgi_binpath }
+    }
+
+    file{$real_cgi_binpath:
+        ensure => $ensure ? {
+          'absent' => 'absent',
+          default => directory
+        },
+        owner => $documentroot_owner,
+        group => $documentroot_group,
+        mode => $documentroot_mode;
+    }
+
+    if $ensure != 'absent' {
+      case $run_mode {
+        'proxy-itk','static-itk': {
+          include ::mod_perl::itk_plus
+        }
+        'fcgid': {
+          include ::mod_fcgid
+          include apache::include::mod_fcgid
+
+          # we don't need mod_perl if we run it as fcgid
+          include ::mod_perl::disable
+          mod_fcgid::starter {$name:
+            cgi_type => 'perl',
+            owner => $run_uid,
+            group => $run_gid,
+            notify => Service['apache'],
+          }
+        }
+        default: { include ::mod_perl }
+      }
+    }
+
+    # create webdir
+    ::apache::vhost::webdir{$name:
+        ensure => $ensure,
+        path => $path,
+        owner => $owner,
+        group => $group,
+        run_mode => $run_mode,
+        documentroot_owner => $documentroot_owner,
+        documentroot_group => $documentroot_group,
+        documentroot_mode => $documentroot_mode,
+    }
+
+    # create vhost configuration file
+    ::apache::vhost{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        path => $path,
+        logmode => $logmode,
+        vhost_mode => $vhost_mode,
+        template_partial => $template_partial,
+        vhost_source => $vhost_source,
+        vhost_destination => $vhost_destination,
+        domain => $domain,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        run_mode => $run_mode,
+        run_uid => $run_uid,
+        run_gid => $run_gid,
+        allow_override => $allow_override,
+        do_includes => $do_includes,
+        options => $options,
+        additional_options => $additional_options,
+        default_charset => $default_charset,
+        cgi_binpath => $real_cgi_binpath,
+        ssl_mode => $ssl_mode,
+        htpasswd_file => $htpasswd_file,
+        htpasswd_path => $htpasswd_path,
+        mod_security => $mod_security,
+        mod_security_relevantonly => $mod_security_relevantonly,
+        mod_security_rules_to_disable => $mod_security_rules_to_disable,
+        mod_security_additional_options => $mod_security_additional_options,
+        passing_extension => 'pl'
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/passenger.pp b/puppet/modules/apache/manifests/vhost/passenger.pp
new file mode 100644
index 00000000..46218908
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/passenger.pp
@@ -0,0 +1,139 @@
+# run_uid: the uid the vhost should run as with the mod_passenger module
+# run_gid: the gid the vhost should run as with the mod_passenger module
+#
+# logmode:
+#
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*defaul*) activate mod_security
+#
+define apache::vhost::passenger(
+    $ensure = present,
+    $configuration = {},
+    $domain = 'absent',
+    $domainalias = 'absent',
+    $server_admin = 'absent',
+    $logmode = 'default',
+    $path = 'absent',
+    $manage_webdir = true,
+    $manage_docroot = true,
+    $owner = root,
+    $group = apache,
+    $documentroot_owner = apache,
+    $documentroot_group = 0,
+    $documentroot_mode = 0640,
+    $run_uid = 'absent',
+    $run_gid = 'absent',
+    $allow_override = 'None',
+    $do_includes = false,
+    $options = 'absent',
+    $additional_options = 'absent',
+    $default_charset = 'absent',
+    $mod_security = true,
+    $mod_security_relevantonly = true,
+    $mod_security_rules_to_disable = [],
+    $mod_security_additional_options = 'absent',
+    $ssl_mode = false,
+    $vhost_mode = 'template',
+    $template_partial = 'apache/vhosts/passenger/partial.erb',
+    $vhost_source = 'absent',
+    $vhost_destination = 'absent',
+    $htpasswd_file = 'absent',
+    $htpasswd_path = 'absent',
+    $passenger_ree = false,
+    $passenger_app = 'rails'
+){
+
+    if $passenger_ree {
+      include ::passenger::ree::apache
+    } else {
+      include ::passenger::apache
+    }
+
+    if $manage_webdir {
+      # create webdir
+      ::apache::vhost::webdir{$name:
+        ensure => $ensure,
+        path => $path,
+        owner => $owner,
+        group => $group,
+        mode => 0644,
+        run_mode => 'normal',
+        manage_docroot => $manage_docroot,
+        documentroot_owner => $documentroot_owner,
+        documentroot_group => $run_gid,
+        documentroot_mode => $documentroot_mode,
+      }
+    }
+    $real_path = $path ? {
+        'absent' => $::operatingsystem ? {
+            openbsd => "/var/www/htdocs/${name}",
+            default => "/var/www/vhosts/${name}"
+        },
+        default => $path
+    }
+    file{
+      ["${real_path}/www/tmp", "${real_path}/www/log"]:
+        ensure => directory,
+        owner => $documentroot_owner, group => $run_gid, mode => 0660;
+      ["${real_path}/www/public", "${real_path}/gems"]:
+        ensure => directory,
+        owner => $documentroot_owner, group => $run_gid, mode => 0640;
+    }
+    if $passenger_app == 'rails' {
+      file{
+        "${real_path}/www/config":
+          ensure => directory,
+          owner => $documentroot_owner, group => $run_gid, mode => 0640;
+        "${real_path}/www/config/environment.rb":
+          ensure => present,
+          owner => $run_uid, group => $run_gid, mode => 0640;
+      }
+    } else {
+      #rack based
+      file{
+        "${real_path}/www/config.ru":
+          ensure => present,
+          owner => $run_uid, group => $run_gid, mode => 0640;
+      }
+    }
+
+    # create vhost configuration file
+    ::apache::vhost{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        path => "${real_path}/www/public",
+        path_is_webdir => true,
+        template_partial => $template_partial,
+        logmode => $logmode,
+        logpath => "${real_path}/logs",
+        vhost_mode => $vhost_mode,
+        vhost_source => $vhost_source,
+        vhost_destination => $vhost_destination,
+        domain => $domain,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        run_mode => 'normal',
+        run_uid => $run_uid,
+        run_gid => $run_gid,
+        allow_override => $allow_override,
+        do_includes => $do_includes,
+        options => $options,
+        additional_options => $additional_options,
+        default_charset => $default_charset,
+        ssl_mode => $ssl_mode,
+        htpasswd_file => $htpasswd_file,
+        htpasswd_path => $htpasswd_path,
+        mod_security => $mod_security,
+        mod_security_relevantonly => $mod_security_relevantonly,
+        mod_security_rules_to_disable => $mod_security_rules_to_disable,
+        mod_security_additional_options => $mod_security_additional_options,
+        gempath => "${real_path}/gems"
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/drupal.pp b/puppet/modules/apache/manifests/vhost/php/drupal.pp
new file mode 100644
index 00000000..5b15e6a0
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/drupal.pp
@@ -0,0 +1,144 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# php_safe_mode_exec_bins: An array of local binaries which should be linked in the
+#                          safe_mode_exec_bin for this hosting
+#                          *default*: None
+# php_default_charset: default charset header for php.
+#                      *default*: absent, which will set the same as default_charset
+#                                 of apache
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::php::drupal(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_drupal/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_directories               = true,
+  $config_webwriteable              = false,
+  $manage_config                    = true,
+  $manage_cron                      = true
+){
+  $documentroot = $path ? {
+      'absent' => $::operatingsystem ? {
+          openbsd => "/var/www/htdocs/${name}/www",
+          default => "/var/www/vhosts/${name}/www"
+      },
+      default => "${path}/www"
+  }
+
+  if $manage_cron {
+    if $domain == 'absent' {
+      $real_domain = $name
+    } else {
+      $real_domain = $domain
+    }
+
+    file{"/etc/cron.d/drupal_cron_${name}":
+      content => "0   *   *   *   *   apache wget -O - -q -t 1 http://${real_domain}/cron.php\n",
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+    }
+  }
+
+  $std_drupal_php_settings = {
+    magic_quotes_gpc                => 0,
+    register_globals                => 0,
+    'session.auto_start'            => 0,
+    'mbstring.http_input'           => 'pass',
+    'mbstring.http_output'          => 'pass',
+    'mbstring.encoding_translation' => 0,
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => merge($std_drupal_php_settings, $php_settings),
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => false,
+    manage_config                   => false,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/gallery2.pp b/puppet/modules/apache/manifests/vhost/php/gallery2.pp
new file mode 100644
index 00000000..3acb011d
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/gallery2.pp
@@ -0,0 +1,141 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: (*defaul*) don't activate mod_security
+#    - true: activate mod_security
+#
+# php_safe_mode_exec_bins: An array of local binaries which should be linked in the
+#                          safe_mode_exec_bin for this hosting
+#                          *default*: None
+# php_default_charset: default charset header for php.
+#                      *default*: absent, which will set the same as default_charset
+#                                 of apache
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::gallery2(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = 0640,
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = false,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_gallery2/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+){
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+  $upload_dir = "/var/www/vhosts/${name}/data/upload"
+  $gdata_dir = "/var/www/vhosts/${name}/data/gdata"
+  if $ensure != 'absent' {
+    file{
+      $gdata_dir:
+        ensure  => 'directory',
+        owner   => $documentroot_owner,
+        group   => $documentroot_group,
+        mode    => '0660';
+      $upload_dir:
+        ensure  => 'directory',
+        owner   => $documentroot_owner,
+        group   => $documentroot_group,
+        mode    => '0660';
+    }
+  }
+
+  $gallery_php_settings = {
+    safe_mode        => 'Off',
+    output_buffering => 'Off',
+  }
+  $real_php_settings = merge($gallery_php_settings,$php_settings)
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $real_php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    manage_config                   => $manage_config,
+    config_file                     => 'config.php',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/global_exec_bin_dir.pp b/puppet/modules/apache/manifests/vhost/php/global_exec_bin_dir.pp
new file mode 100644
index 00000000..efcdaf7f
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/global_exec_bin_dir.pp
@@ -0,0 +1,9 @@
+# manage global exec_bin_dir
+class apache::vhost::php::global_exec_bin_dir {
+  file{'/var/www/php_safe_exec_bins':
+    ensure  => directory,
+    owner   => root,
+    group   => apache,
+    mode    => '0640';
+  }
+}
diff --git a/puppet/modules/apache/manifests/vhost/php/joomla.pp b/puppet/modules/apache/manifests/vhost/php/joomla.pp
new file mode 100644
index 00000000..ed0696f8
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/joomla.pp
@@ -0,0 +1,174 @@
+# run_mode: controls in which mode the vhost should be run, there are different
+#           setups possible:
+#   - normal: (*default*) run vhost with the current active worker
+#             (default: prefork) don't setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in
+#          combination with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just
+#                proxies all the requests for the itk setup, that listens only
+#                on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk
+#                setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves
+#                 all the static
+#                 content and proxies the dynamic calls to the itk setup, that
+#                 listens only on the loobpack device
+#                 (Incompatibility: cannot be used in combination with 'itk'
+#                 mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security
+#               module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::joomla(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $php_installation                 = 'system',
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_joomla/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true
+){
+  include ::apache::include::joomla
+
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+
+  if $mod_security_additional_options == 'absent' {
+    $id_str = $::operatingsystem ? {
+      'CentOS'  => $::operatingsystemmajrelease ? {
+        5       => '',
+        default => 'id:1199400,'
+      },
+      default => ''
+    }
+    $real_mod_security_additional_options = "
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"${id_str}allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+"
+  } else {
+    $real_mod_security_additional_options = $mod_security_additional_options
+  }
+
+  $std_joomla_php_settings = {
+    'allow_url_fopen'   => 'on',
+    'allow_url_include' => 'off',
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{
+    $name:
+      ensure                          => $ensure,
+      configuration                   => $configuration,
+      domain                          => $domain,
+      domainalias                     => $domainalias,
+      server_admin                    => $server_admin,
+      logmode                         => $logmode,
+      path                            => $path,
+      owner                           => $owner,
+      group                           => $group,
+      documentroot_owner              => $documentroot_owner,
+      documentroot_group              => $documentroot_group,
+      documentroot_mode               => $documentroot_mode,
+      run_mode                        => $run_mode,
+      run_uid                         => $run_uid,
+      run_gid                         => $run_gid,
+      allow_override                  => $allow_override,
+      php_settings                    => merge($std_joomla_php_settings,
+        $php_settings),
+      php_options                     => $php_options,
+      php_installation                => $php_installation,
+      do_includes                     => $do_includes,
+      options                         => $options,
+      additional_options              => $additional_options,
+      default_charset                 => $default_charset,
+      mod_security                    => $mod_security,
+      mod_security_relevantonly       => $mod_security_relevantonly,
+      mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+      mod_security_additional_options => $real_mod_security_additional_options,
+      ssl_mode                        => $ssl_mode,
+      vhost_mode                      => $vhost_mode,
+      template_partial                => $template_partial,
+      vhost_source                    => $vhost_source,
+      vhost_destination               => $vhost_destination,
+      htpasswd_file                   => $htpasswd_file,
+      htpasswd_path                   => $htpasswd_path,
+      manage_directories              => $manage_directories,
+      managed_directories             => [ "${documentroot}/administrator/backups",
+                                            "${documentroot}/administrator/components",
+                                            "${documentroot}/administrator/language",
+                                            "${documentroot}/administrator/modules",
+                                            "${documentroot}/administrator/templates",
+                                            "${documentroot}/components",
+                                            "${documentroot}/dmdocuments",
+                                            "${documentroot}/images",
+                                            "${documentroot}/language",
+                                            "${documentroot}/media",
+                                            "${documentroot}/modules",
+                                            "${documentroot}/plugins",
+                                            "${documentroot}/templates",
+                                            "${documentroot}/cache",
+                                            "${documentroot}/tmp",
+                                            "${documentroot}/administrator/cache" ],
+      manage_config                   => $manage_config,
+      config_webwriteable             => $config_webwriteable,
+      config_file                     => 'configuration.php',
+  }
+
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/mediawiki.pp b/puppet/modules/apache/manifests/vhost/php/mediawiki.pp
new file mode 100644
index 00000000..25881ca1
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/mediawiki.pp
@@ -0,0 +1,106 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::mediawiki(
+  $ensure = present,
+  $configuration = {},
+  $domain = 'absent',
+  $domainalias = 'absent',
+  $server_admin = 'absent',
+  $logmode = 'default',
+  $path = 'absent',
+  $manage_docroot = true,
+  $owner = root,
+  $group = apache,
+  $documentroot_owner = apache,
+  $documentroot_group = 0,
+  $documentroot_mode = 0640,
+  $run_mode = 'normal',
+  $run_uid = 'absent',
+  $run_gid = 'absent',
+  $allow_override = 'FileInfo Limit',
+  $php_settings = {},
+  $php_options = {},
+  $options = 'absent',
+  $additional_options = 'absent',
+  $default_charset = 'absent',
+  $mod_security = true,
+  $mod_security_relevantonly = true,
+  $mod_security_rules_to_disable = [],
+  $mod_security_additional_options = 'absent',
+  $ssl_mode = false,
+  $vhost_mode = 'template',
+  $template_partial = 'apache/vhosts/php_mediawiki/partial.erb',
+  $vhost_source = 'absent',
+  $vhost_destination = 'absent',
+  $htpasswd_file = 'absent',
+  $htpasswd_path = 'absent'
+){
+
+  $mediawiki_php_settings = {
+    safe_mode => false,
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    manage_docroot                  => $manage_docroot,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => merge($mediawiki_php_settings,$php_settings),
+    php_options                     => $php_options,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => false,
+    manage_config                   => false,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/safe_mode_bin.pp b/puppet/modules/apache/manifests/vhost/php/safe_mode_bin.pp
new file mode 100644
index 00000000..1c82e199
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/safe_mode_bin.pp
@@ -0,0 +1,17 @@
+# safe_mode binaries
+define apache::vhost::php::safe_mode_bin(
+  $ensure = 'present',
+  $path
+){
+  $substr=regsubst($name,'^.*\/','','G')
+  $real_path = "${path}/${substr}"
+  $target = $ensure ? {
+    'present' => regsubst($name,'^.*@',''),
+    default => absent,
+  }
+  file{$real_path:
+    ensure => link,
+    target => $target,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/silverstripe.pp b/puppet/modules/apache/manifests/vhost/php/silverstripe.pp
new file mode 100644
index 00000000..1f19eab4
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/silverstripe.pp
@@ -0,0 +1,119 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::silverstripe(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_silverstripe/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+){
+
+  include ::apache::include::silverstripe
+
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+  $modsec_rules = ['960010']
+  $real_mod_security_rules_to_disable = union($mod_security_rules_to_disable,$modsec_rules)
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    managed_directories             =>  [ "${documentroot}/assets" ],
+    manage_config                   => $manage_config,
+  }
+
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/simplemachine.pp b/puppet/modules/apache/manifests/vhost/php/simplemachine.pp
new file mode 100644
index 00000000..3fa11a77
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/simplemachine.pp
@@ -0,0 +1,125 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::simplemachine(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+){
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    managed_directories             => [
+      "${documentroot}/agreement.txt",
+      "${documentroot}/attachments",
+      "${documentroot}/avatars",
+      "${documentroot}/cache",
+      "${documentroot}/Packages",
+      "${documentroot}/Packages/installed.list",
+      "${documentroot}/Smileys",
+      "${documentroot}/Themes",
+      "${documentroot}/Themes/default/languages/Install.english.php"
+    ],
+    manage_config                   => $manage_config,
+    config_webwriteable             => $config_webwriteable,
+    config_file                     => 'Settings.php',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/spip.pp b/puppet/modules/apache/manifests/vhost/php/spip.pp
new file mode 100644
index 00000000..e33c1dfe
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/spip.pp
@@ -0,0 +1,114 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::spip(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'FileInfo',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $template_partial                 = 'apache/vhosts/php/partial.erb',
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent'
+){
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    managed_directories             => [
+      "${documentroot}/IMG",
+      "${documentroot}/tmp",
+      "${documentroot}/local",
+      "${documentroot}/config"
+    ],
+    manage_config                   => false,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/standard.pp b/puppet/modules/apache/manifests/vhost/php/standard.pp
new file mode 100644
index 00000000..3870707a
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/standard.pp
@@ -0,0 +1,304 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::standard(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $logpath                          = 'absent',
+  $logprefix                        = '',
+  $path                             = 'absent',
+  $manage_webdir                    = true,
+  $path_is_webdir                   = false,
+  $manage_docroot                   = true,
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = 0640,
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $php_installation                 = 'system',
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $use_mod_macro                    = false,
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+){
+
+  if $manage_webdir {
+    # create webdir
+    ::apache::vhost::webdir{$name:
+      ensure              => $ensure,
+      path                => $path,
+      owner               => $owner,
+      group               => $group,
+      run_mode            => $run_mode,
+      manage_docroot      => $manage_docroot,
+      documentroot_owner  => $documentroot_owner,
+      documentroot_group  => $documentroot_group,
+      documentroot_mode   => $documentroot_mode,
+    }
+  }
+
+  $real_path = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}",
+      default => "/var/www/vhosts/${name}"
+    },
+    default   => $path
+  }
+
+  if $path_is_webdir {
+    $documentroot = $real_path
+  } else {
+    $documentroot = "${real_path}/www"
+  }
+  $logdir = $logpath ? {
+    'absent'  => "${real_path}/logs",
+    default   => $logpath
+  }
+
+  $std_php_options = {
+    smarty  => false,
+    pear    => false,
+  }
+  $real_php_options = merge($std_php_options,$php_options)
+
+  if $real_php_options[smarty] {
+    include php::extensions::smarty
+    $smarty_path = '/usr/share/php/Smarty/:'
+  } else {
+    $smarty_path = ''
+  }
+
+  if $real_php_options[pear] {
+    $pear_path = '/usr/share/pear/:'
+  } else {
+    $pear_path = ''
+  }
+
+  if $logmode != 'nologs' {
+    $php_error_log = "${logdir}/php_error_log"
+  } else {
+    $php_error_log = undef
+  }
+
+  if ('safe_mode_exec_dir' in $php_settings) {
+    $php_safe_mode_exec_dir = $php_settings[safe_mode_exec_dir]
+  } else {
+    $php_safe_mode_exec_dir =  $path ? {
+      'absent' => $::operatingsystem ? {
+        openbsd => "/var/www/htdocs/${name}/bin",
+        default => "/var/www/vhosts/${name}/bin"
+      },
+      default   => "${path}/bin"
+    }
+  }
+  file{$php_safe_mode_exec_dir:
+    recurse => true,
+    force   => true,
+    purge   => true,
+  }
+  if ('safe_mode_exec_bins' in $php_options) {
+    $std_php_settings_safe_mode_exec_dir = $php_safe_mode_exec_dir
+    $ensure_exec = $ensure ? {
+      'present'  => directory,
+      default    => 'absent',
+    }
+    File[$php_safe_mode_exec_dir]{
+      ensure => $ensure_exec,
+      owner  => $documentroot_owner,
+      group  => $documentroot_group,
+      mode   => '0750',
+    }
+    $php_safe_mode_exec_bins_subst = regsubst($php_options[safe_mode_exec_bins],'(.+)',"${name}@\\1")
+    apache::vhost::php::safe_mode_bin{
+      $php_safe_mode_exec_bins_subst:
+        ensure  => $ensure,
+        path    => $php_safe_mode_exec_dir;
+    }
+  } else {
+    $std_php_settings_safe_mode_exec_dir = undef
+    File[$php_safe_mode_exec_dir]{
+      ensure => absent,
+    }
+  }
+
+  if !('default_charset' in $php_settings) and ($default_charset != 'absent') {
+    $std_php_settings_default_charset =  $default_charset ? {
+      'On'    => 'iso-8859-1',
+      default => $default_charset
+    }
+  } else {
+    $std_php_settings_default_charset = undef
+  }
+
+  if ('additional_open_basedir' in $php_options) {
+    $the_open_basedir = "${smarty_path}${pear_path}${documentroot}:${real_path}/data:/var/www/upload_tmp_dir/${name}:/var/www/session.save_path/${name}:${php_options[additional_open_basedir]}"
+  } else {
+    $the_open_basedir = "${smarty_path}${pear_path}${documentroot}:${real_path}/data:/var/www/upload_tmp_dir/${name}:/var/www/session.save_path/${name}"
+  }
+
+  if $run_mode == 'fcgid' {
+    $safe_mode_gid = $::operatingsystem ? {
+      debian  => undef,
+      default => $php_installation ? {
+        'system'  => 'On',
+        default   => undef,
+      }
+    }
+  } else {
+    $safe_mode_gid = undef
+  }
+
+  $safe_mode = $::operatingsystem ? {
+    debian  => undef,
+    default => $php_installation ? {
+      'system'  => 'On',
+      default   => undef,
+    }
+  }
+  $std_php_settings = {
+    engine              => 'On',
+    upload_tmp_dir      => "/var/www/upload_tmp_dir/${name}",
+    'session.save_path' => "/var/www/session.save_path/${name}",
+    error_log           => $php_error_log,
+    safe_mode           => $safe_mode,
+    safe_mode_gid       => $safe_mode_gid,
+    safe_mode_exec_dir  => $std_php_settings_safe_mode_exec_dir,
+    default_charset     => $std_php_settings_default_charset,
+    open_basedir        => $the_open_basedir,
+  }
+
+  $real_php_settings = merge($std_php_settings,$php_settings)
+
+  if $ensure != 'absent' {
+    case $run_mode {
+      'proxy-itk','static-itk': {
+        include ::php::itk_plus
+      }
+      'itk': { include ::php::itk }
+      'fcgid': {
+        include ::mod_fcgid
+        include ::php::mod_fcgid
+        include apache::include::mod_fcgid
+
+        mod_fcgid::starter {$name:
+          tmp_dir          => $real_php_settings[php_tmp_dir],
+          cgi_type         => 'php',
+          cgi_type_options => delete($real_php_settings, php_tmp_dir),
+          owner            => $run_uid,
+          group            => $run_gid,
+          notify           => Service['apache'],
+        }
+        if $php_installation == 'scl54' {
+          require php::scl::php54
+          Mod_fcgid::Starter[$name]{
+            binary          => '/opt/rh/php54/root/usr/bin/php-cgi',
+            additional_cmds => 'source /opt/rh/php54/enable',
+            rc              => '/opt/rh/php54/root/etc',
+          }
+        } elsif $php_installation == 'scl55' {
+          require php::scl::php55
+          Mod_fcgid::Starter[$name]{
+            binary          => '/opt/rh/php55/root/usr/bin/php-cgi',
+            additional_cmds => 'source /opt/rh/php55/enable',
+            rc              => '/opt/rh/php55/root/etc',
+          }
+        }
+      }
+      default: { include ::php }
+    }
+  }
+
+  ::apache::vhost::phpdirs{$name:
+    ensure                => $ensure,
+    php_upload_tmp_dir    => $real_php_settings[upload_tmp_dir],
+    php_session_save_path => $real_php_settings['session.save_path'],
+    documentroot_owner    => $documentroot_owner,
+    documentroot_group    => $documentroot_group,
+    documentroot_mode     => $documentroot_mode,
+    run_mode              => $run_mode,
+    run_uid               => $run_uid,
+  }
+
+  # create vhost configuration file
+  ::apache::vhost{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    path                            => $path,
+    path_is_webdir                  => $path_is_webdir,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    logpath                         => $logpath,
+    logprefix                       => $logprefix,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    php_settings                    => $real_php_settings,
+    php_options                     => $real_php_options,
+    ssl_mode                        => $ssl_mode,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    use_mod_macro                   => $use_mod_macro,
+    passing_extension               => 'php',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/typo3.pp b/puppet/modules/apache/manifests/vhost/php/typo3.pp
new file mode 100644
index 00000000..d9e877a6
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/typo3.pp
@@ -0,0 +1,150 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::typo3(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_typo3/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+){
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+        openbsd => "/var/www/htdocs/${name}/www",
+        default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+
+  $modsec_rules = ['960010']
+  $real_mod_security_rules_to_disable = union($mod_security_rules_to_disable,$modsec_rules)
+  if $mod_security_additional_options == 'absent' {
+  $real_mod_security_additional_options = '
+    <Location "/typo3">
+      SecRuleEngine Off
+      SecAuditEngine Off
+    </Location>
+'
+  } else {
+    $real_mod_security_additional_options = $mod_security_additional_options
+  }
+
+  $typo3_php_settings = {
+    # turn allow_url_fopen on for the extension manager fetch
+    allow_url_fopen => 'On'
+  }
+  $real_php_settings = merge($typo3_php_settings,$php_settings)
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $real_php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $real_mod_security_rules_to_disable,
+    mod_security_additional_options => $real_mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    managed_directories             =>  [ "${documentroot}/typo3temp",
+                                          "${documentroot}/typo3temp/pics",
+                                          "${documentroot}/typo3temp/temp",
+                                          "${documentroot}/typo3temp/llxml",
+                                          "${documentroot}/typo3temp/cs",
+                                          "${documentroot}/typo3temp/GB",
+                                          "${documentroot}/typo3temp/locks",
+                                          "${documentroot}/typo3conf",
+                                          "${documentroot}/typo3conf/ext",
+                                          "${documentroot}/typo3conf/l10n",
+                                          # "${documentroot}/typo3/ext/", # only needed for ext manager installing global extensions
+                                          "${documentroot}/uploads",
+                                          "${documentroot}/uploads/pics",
+                                          "${documentroot}/uploads/media",
+                                          "${documentroot}/uploads/tf",
+                                          "${documentroot}/fileadmin",
+                                          "${documentroot}/fileadmin/_temp_"
+                                        ],
+    manage_config                   => $manage_config,
+  }
+
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/webapp.pp b/puppet/modules/apache/manifests/vhost/php/webapp.pp
new file mode 100644
index 00000000..695120d0
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/webapp.pp
@@ -0,0 +1,148 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::webapp(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $manage_webdir                    = true,
+  $manage_docroot                   = true,
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $php_installation                 = 'system',
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial,
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_file                      = 'absent',
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+  $managed_directories              = 'absent',
+){
+  if ($ensure != 'absent') {
+    if $manage_directories and ($managed_directories != 'absent') {
+      ::apache::file::rw{ $managed_directories :
+        owner => $documentroot_owner,
+        group => $documentroot_group,
+      }
+    }
+
+    if $manage_config {
+      if $config_file == 'absent' { fail("No config file defined for ${name} on ${::fqdn}, if you'd like to manage the config, you have to add one!") }
+
+      $real_path = $path ? {
+        'absent' => $::operatingsystem ? {
+          openbsd => "/var/www/htdocs/${name}",
+          default => "/var/www/vhosts/${name}"
+        },
+        default => $path
+      }
+      $documentroot = "${real_path}/www"
+      ::apache::vhost::file::documentrootfile{"configurationfile_${name}":
+        documentroot  => $documentroot,
+        filename      => $config_file,
+        thedomain     => $name,
+        owner         => $documentroot_owner,
+        group         => $documentroot_group,
+      }
+      if $config_webwriteable {
+        Apache::Vhost::File::Documentrootfile["configurationfile_${name}"]{
+          mode => '0660',
+        }
+      } else {
+        Apache::Vhost::File::Documentrootfile["configurationfile_${name}"]{
+          mode => '0440',
+        }
+      }
+    }
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::standard{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    manage_webdir                   => $manage_webdir,
+    manage_docroot                  => $manage_docroot,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    php_installation                => $php_installation,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/wordpress.pp b/puppet/modules/apache/manifests/vhost/php/wordpress.pp
new file mode 100644
index 00000000..a6bbe434
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/wordpress.pp
@@ -0,0 +1,123 @@
+# run_mode: controls in which mode the vhost should be run, there are different
+#           setups #           possible:
+#   - normal: (*default*) run vhost with the current active worker
+#             (default: prefork) don't setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in
+#          combination with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just
+#                proxies all the requests for the itk setup, that listens only
+#                on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk
+#                 setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves
+#                 all the static content and proxies the dynamic calls to the
+#                 itk setup, that listens only on the loobpack device
+#                 (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security
+#               module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::wordpress(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'FileInfo Indexes',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_wordpress/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true
+){
+
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+        'openbsd' => "/var/www/htdocs/${name}/www",
+        default   => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+  $modsec_rules = ['960010', '950018']
+  $real_mod_security_rules_to_disable = union($mod_security_rules_to_disable,
+                                                $modsec_rules)
+
+  # create vhost configuration file
+  apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $real_mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    managed_directories             => [ "${documentroot}/wp-content/uploads",],
+    manage_config                   => $manage_config,
+    config_webwriteable             => $config_webwriteable,
+    config_file                     => 'wp-config.php',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/phpdirs.pp b/puppet/modules/apache/manifests/vhost/phpdirs.pp
new file mode 100644
index 00000000..5936da61
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/phpdirs.pp
@@ -0,0 +1,39 @@
+define apache::vhost::phpdirs(
+  $ensure = present,
+  $php_upload_tmp_dir,
+  $php_session_save_path,
+  $documentroot_owner = apache,
+  $documentroot_group = 0,
+  $documentroot_mode = 0750,
+  $run_mode = 'normal',
+  $run_uid = 'absent'
+){
+  case $ensure {
+    absent : {
+      file {
+        [$php_upload_tmp_dir, $php_session_save_path] :
+          ensure => absent,
+          purge => true,
+          force => true,
+          recurse => true,
+      }
+    }
+    default : {
+      include apache::defaultphpdirs
+      file {
+        [$php_upload_tmp_dir, $php_session_save_path] :
+          ensure => directory,
+          owner => $run_mode ? {
+            'itk' => $run_uid,
+            'static-itk' => $run_uid,
+            'proxy-itk' => $run_uid,
+            'fcgid' => $run_uid,
+            default => $documentroot_owner
+          },
+          group => $documentroot_group,
+          mode => $documentroot_mode ;
+      }
+    }
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/proxy.pp b/puppet/modules/apache/manifests/vhost/proxy.pp
new file mode 100644
index 00000000..95ae2059
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/proxy.pp
@@ -0,0 +1,67 @@
+# Proxy VHost
+# Parameters:
+#
+# - ensure: wether this vhost is `present` or `absent`
+# - domain: the domain to redirect (*name*)
+# - domainalias: A list of whitespace seperated domains to redirect
+# - target_url: the url to be proxied. Note: We don't want http://example.com/foobar only example.com/foobar
+# - server_admin: the email that is shown as responsible
+# - ssl_mode: wether this vhost supports ssl or not
+#   - false: don't enable ssl for this vhost (default)
+#   - true: enable ssl for this vhost
+#   - force: enable ssl and redirect non-ssl to ssl
+#   - only: enable ssl only
+#
+# logmode:
+#
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::proxy(
+    $ensure = present,
+    $configuration = {},
+    $domain = 'absent',
+    $domainalias = 'absent',
+    $htpasswd_file = 'absent',
+    $target_url,
+    $server_admin = 'absent',
+    $logmode = 'default',
+    $mod_security = false,
+    $ssl_mode = false,
+    $mod_security_relevantonly = true,
+    $mod_security_rules_to_disable = [],
+    $mod_security_additional_options = 'absent',
+    $additional_options = 'absent'
+){
+    # create vhost configuration file
+    # we use the options field as the target_url
+    ::apache::vhost::template{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        template_partial => 'apache/vhosts/proxy/partial.erb',
+        domain => $domain,
+        path => 'really_absent',
+        path_is_webdir => true,
+        htpasswd_file => $htpasswd_file,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        logpath => $::operatingsystem ? {
+          openbsd => '/var/www/logs',
+          centos => '/var/log/httpd',
+          default => '/var/log/apache2'
+        },
+        logmode => $logmode,
+        allow_override => $allow_override,
+        run_mode => 'normal',
+        mod_security => $mod_security,
+        mod_security_relevantonly => $mod_security_relevantonly,
+        mod_security_rules_to_disable => $mod_security_rules_to_disable,
+        mod_security_additional_options => $mod_security_additional_options,
+        options => $target_url,
+        ssl_mode => $ssl_mode,
+        additional_options => $additional_options,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/redirect.pp b/puppet/modules/apache/manifests/vhost/redirect.pp
new file mode 100644
index 00000000..0ac40cc3
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/redirect.pp
@@ -0,0 +1,56 @@
+# Redirect VHost to redirect hosts
+# Parameters:
+#
+# - ensure: wether this vhost is `present` or `absent`
+# - domain: the domain to redirect (*name*)
+# - domainalias: A list of whitespace seperated domains to redirect
+# - target_url: the url to redirect to. Note: We don't want http://example.com/foobar only example.com/foobar
+# - server_admin: the email that is shown as responsible
+# - ssl_mode: wether this vhost supports ssl or not
+#   - false: don't enable ssl for this vhost (default)
+#   - true: enable ssl for this vhost
+#   - force: enable ssl and redirect non-ssl to ssl
+#   - only: enable ssl only
+#
+# logmode:
+#
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::redirect(
+    $ensure = present,
+    $configuration = {},
+    $domain = 'absent',
+    $domainalias = 'absent',
+    $target_url,
+    $server_admin = 'absent',
+    $logmode = 'default',
+    $ssl_mode = false
+){
+    # create vhost configuration file
+    # we use the options field as the target_url
+    ::apache::vhost::template{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        template_partial => 'apache/vhosts/redirect/partial.erb',
+        domain => $domain,
+        path => 'really_absent',
+        path_is_webdir => true,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        logpath => $::operatingsystem ? {
+          openbsd => '/var/www/logs',
+          centos => '/var/log/httpd',
+          default => '/var/log/apache2'
+        },
+        logmode => $logmode,
+        allow_override => $allow_override,
+        run_mode => 'normal',
+        mod_security => false,
+        options => $target_url,
+        ssl_mode => $ssl_mode,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/static.pp b/puppet/modules/apache/manifests/vhost/static.pp
new file mode 100644
index 00000000..f9197662
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/static.pp
@@ -0,0 +1,86 @@
+# vhost_mode: which option is chosen to deploy the vhost
+#   - template: generate it from a template (default)
+#   - file: deploy a vhost file (apache::vhost::file will be called directly)
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: (*default*) don't activate mod_security
+#    - true: activate mod_security
+#
+define apache::vhost::static(
+    $ensure                           = present,
+    $configuration                    = {},
+    $domain                           = 'absent',
+    $domainalias                      = 'absent',
+    $server_admin                     = 'absent',
+    $logmode                          = 'default',
+    $path                             = 'absent',
+    $owner                            = root,
+    $group                            = apache,
+    $documentroot_owner               = apache,
+    $documentroot_group               = 0,
+    $documentroot_mode                = 0640,
+    $allow_override                   = 'None',
+    $do_includes                      = false,
+    $options                          = 'absent',
+    $additional_options               = 'absent',
+    $default_charset                  = 'absent',
+    $ssl_mode                         = false,
+    $run_mode                         = 'normal',
+    $vhost_mode                       = 'template',
+    $template_partial                 = 'apache/vhosts/static/partial.erb',
+    $vhost_source                     = 'absent',
+    $vhost_destination                = 'absent',
+    $htpasswd_file                    = 'absent',
+    $htpasswd_path                    = 'absent',
+    $mod_security                     = false,
+    $mod_security_relevantonly        = true,
+    $mod_security_rules_to_disable    = [],
+    $mod_security_additional_options  = 'absent'
+){
+    # create webdir
+    ::apache::vhost::webdir{$name:
+        ensure              => $ensure,
+        path                => $path,
+        owner               => $owner,
+        group               => $group,
+        run_mode            => $run_mode,
+        datadir             => false,
+        documentroot_owner  => $documentroot_owner,
+        documentroot_group  => $documentroot_group,
+        documentroot_mode   => $documentroot_mode,
+    }
+
+    # create vhost configuration file
+    ::apache::vhost{$name:
+        ensure                          => $ensure,
+        configuration                   => $configuration,
+        path                            => $path,
+        template_partial                => $template_partial,
+        vhost_mode                      => $vhost_mode,
+        vhost_source                    => $vhost_source,
+        vhost_destination               => $vhost_destination,
+        domain                          => $domain,
+        domainalias                     => $domainalias,
+        server_admin                    => $server_admin,
+        logmode                         => $logmode,
+        allow_override                  => $allow_override,
+        do_includes                     => $do_includes,
+        options                         => $options,
+        additional_options              => $additional_options,
+        default_charset                 => $default_charset,
+        ssl_mode                        => $ssl_mode,
+        htpasswd_file                   => $htpasswd_file,
+        htpasswd_path                   => $htpasswd_path,
+        mod_security                    => $mod_security,
+        mod_security_relevantonly       => $mod_security_relevantonly,
+        mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+        mod_security_additional_options => $mod_security_additional_options,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/template.pp b/puppet/modules/apache/manifests/vhost/template.pp
new file mode 100644
index 00000000..8e9b798c
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/template.pp
@@ -0,0 +1,158 @@
+# template_partial:
+#  which template should be used to generate the type specific part
+#  of the vhost entry.
+#
+# domainalias:
+#   - absent: no domainalias is set (*default*)
+#   - www: domainalias is set to www.$domain
+#   - else: domainalias is set to that
+#
+# ssl_mode: wether this vhost supports ssl or not
+#   - false: don't enable ssl for this vhost (default)
+#   - true: enable ssl for this vhost
+#   - force: enable ssl and redirect non-ssl to ssl
+#   - only: enable ssl only
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+define apache::vhost::template(
+    $ensure                           = present,
+    $configuration                    = {},
+    $path                             = 'absent',
+    $path_is_webdir                   = false,
+    $logpath                          = 'absent',
+    $logmode                          = 'default',
+    $logprefix                        = '',
+    $domain                           = 'absent',
+    $domainalias                      = 'absent',
+    $server_admin                     = 'absent',
+    $allow_override                   = 'None',
+    $dav_db_dir                       = 'absent',
+    $cgi_binpath                      = 'absent',
+    $do_includes                      = false,
+    $options                          = 'absent',
+    $additional_options               = 'absent',
+    $default_charset                  = 'absent',
+    $php_options                      = {},
+    $php_settings                     = {},
+    $run_mode                         = 'normal',
+    $run_uid                          = 'absent',
+    $run_gid                          = 'absent',
+    $template_partial                 = 'apache/vhosts/static/partial.erb',
+    $template_vars                    = {},
+    $ssl_mode                         = false,
+    $mod_security                     = true,
+    $mod_security_relevantonly        = true,
+    $mod_security_rules_to_disable    = [],
+    $mod_security_additional_options  = 'absent',
+    $use_mod_macro                    = false,
+    $htpasswd_file                    = 'absent',
+    $htpasswd_path                    = 'absent',
+    $ldap_auth                        = false,
+    $ldap_user                        = 'any',
+    $passing_extension                = 'absent',
+    $gempath                          = 'absent'
+){
+    $real_path = $path ? {
+        'absent'  => $::operatingsystem ? {
+            openbsd => "/var/www/htdocs/${name}",
+            default => "/var/www/vhosts/${name}"
+        },
+        default   => $path
+    }
+
+    if $path_is_webdir {
+        $documentroot = $real_path
+    } else {
+        $documentroot = "${real_path}/www"
+    }
+    $logdir = $logpath ? {
+        'absent'  => "${real_path}/logs",
+        default   => $logpath
+    }
+
+    $servername = $domain ? {
+        'absent'  => $name,
+        default   => $domain
+    }
+    $serveralias = $domainalias ? {
+        'absent'  => '',
+        'www'     => "www.${servername}",
+        default   => $domainalias
+    }
+    if $htpasswd_path == 'absent' {
+      $real_htpasswd_path = "/var/www/htpasswds/${name}"
+    } else {
+      $real_htpasswd_path = $htpasswd_path
+    }
+    case $run_mode {
+      'proxy-itk': { $logfileprefix = 'proxy' }
+      'static-itk': { $logfileprefix = 'static' }
+    }
+    case $run_mode {
+        'fcgid','itk','proxy-itk','static-itk': {
+            case $run_uid {
+                'absent': { fail("you have to define run_uid for ${name} on ${::fqdn}") }
+            }
+            case $run_gid {
+                'absent': { fail("you have to define run_gid for ${name} on ${::fqdn}") }
+            }
+        }
+    }
+
+    # dav db dir
+    case $dav_db_dir {
+        'absent': {
+            $real_dav_db_dir = "/var/www/dav_db_dir/${name}"
+        }
+        default: { $real_dav_db_dir = $dav_db_dir }
+    }
+
+    apache::vhost::file{$name:
+        configuration => $configuration,
+        ensure        => $ensure,
+        do_includes   => $do_includes,
+        run_mode      => $run_mode,
+        ssl_mode      => $ssl_mode,
+        logmode       => $logmode,
+        mod_security  => $mod_security,
+        htpasswd_file => $htpasswd_file,
+        htpasswd_path => $htpasswd_path,
+        use_mod_macro => $use_mod_macro,
+    }
+    if $ensure != 'absent' {
+      Apache::Vhost::File[$name]{
+        content => $run_mode ? {
+          'proxy-itk'  => template('apache/vhosts/itk_plus.erb'),
+          'static-itk' => template('apache/vhosts/itk_plus.erb'),
+          default      => template('apache/vhosts/default.erb'),
+        }
+      }
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/webdav.pp b/puppet/modules/apache/manifests/vhost/webdav.pp
new file mode 100644
index 00000000..ff9e8abc
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/webdav.pp
@@ -0,0 +1,126 @@
+# Webdav vhost: to manage webdav accessible targets
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: this mode is not possible and will be rewritten to proxy-itk
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: (*default*) don't activate mod_security
+#    - true: activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::webdav(
+    $ensure                           = present,
+    $configuration                    = {},
+    $domain                           = 'absent',
+    $domainalias                      = 'absent',
+    $server_admin                     = 'absent',
+    $path                             = 'absent',
+    $owner                            = root,
+    $group                            = apache,
+    $manage_webdir                    = true,
+    $path_is_webdir                   = false,
+    $logmode                          = 'default',
+    $logpath                          = 'absent',
+    $documentroot_owner               = apache,
+    $documentroot_group               = 0,
+    $documentroot_mode                = 0640,
+    $run_mode                         = 'normal',
+    $run_uid                          = 'absent',
+    $run_gid                          = 'absent',
+    $options                          = 'absent',
+    $additional_options               = 'absent',
+    $default_charset                  = 'absent',
+    $mod_security                     = false,
+    $mod_security_relevantonly        = true,
+    $mod_security_rules_to_disable    = [],
+    $mod_security_additional_options  = 'absent',
+    $ssl_mode                         = false,
+    $vhost_mode                       = 'template',
+    $vhost_source                     = 'absent',
+    $vhost_destination                = 'absent',
+    $htpasswd_file                    = 'absent',
+    $htpasswd_path                    = 'absent',
+    $ldap_auth                        = false,
+    $ldap_user                        = 'any',
+    $dav_db_dir                       = 'absent'
+){
+  ::apache::vhost::davdbdir{$name:
+    ensure              => $ensure,
+    dav_db_dir          => $dav_db_dir,
+    documentroot_owner  => $documentroot_owner,
+    documentroot_group  => $documentroot_group,
+    documentroot_mode   => $documentroot_mode,
+    run_mode            => $run_mode,
+    run_uid             => $run_uid,
+  }
+
+  if $manage_webdir {
+    # create webdir
+    ::apache::vhost::webdir{$name:
+      ensure              => $ensure,
+      path                => $path,
+      owner               => $owner,
+      group               => $group,
+      run_mode            => $run_mode,
+      datadir             => false,
+      documentroot_owner  => $documentroot_owner,
+      documentroot_group  => $documentroot_group,
+      documentroot_mode   => $documentroot_mode,
+    }
+  }
+
+  if $run_mode == 'static-itk' {
+    notice('static-itk mode is not possible for webdav vhosts, rewriting it to proxy-itk')
+    $real_run_mode = 'proxy-itk'
+  } else {
+    $real_run_mode = $run_mode
+  }
+
+  # create vhost configuration file
+  ::apache::vhost{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    path                            => $path,
+    path_is_webdir                  => $path_is_webdir,
+    logpath                         => $logpath,
+    logmode                         => $logmode,
+    template_partial                => 'apache/vhosts/webdav/partial.erb',
+    vhost_mode                      => $vhost_mode,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    run_mode                        => $real_run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    ssl_mode                        => $ssl_mode,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    ldap_auth                       => $ldap_auth,
+    ldap_user                       => $ldap_user,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/webdir.pp b/puppet/modules/apache/manifests/vhost/webdir.pp
new file mode 100644
index 00000000..e0e25464
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/webdir.pp
@@ -0,0 +1,130 @@
+# create webdir
+define apache::vhost::webdir(
+  $ensure               = present,
+  $path                 = 'absent',
+  $owner                = root,
+  $group                = apache,
+  $mode                 = 0640,
+  $run_mode             = 'normal',
+  $manage_docroot       = true,
+  $datadir              = true,
+  $documentroot_owner   = root,
+  $documentroot_group   = apache,
+  $documentroot_mode    = 0640,
+  $documentroot_recurse = false
+){
+  $real_path = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}",
+      default => "/var/www/vhosts/${name}"
+    },
+    default => $path
+  }
+
+  if (($run_mode =~ /^(static\-|proxy\-)?itk$/) or $run_mode == 'fcgid') and ($mode == '0640'){
+    $real_mode = 0644
+  } else {
+    $real_mode = $mode
+  }
+
+  $documentroot = "${real_path}/www"
+  $logdir = "${real_path}/logs"
+
+  if $owner == 'apache' {
+    $real_owner = $::operatingsystem ? {
+      openbsd => 'www',
+      debian  => 'www-data',
+      default => $owner
+    }
+  } else {
+      $real_owner = $owner
+  }
+  if $group == 'apache' {
+    $real_group = $::operatingsystem ? {
+      openbsd => 'www',
+      debian  => 'www-data',
+      default => $group
+    }
+  } else {
+    $real_group = $group
+  }
+
+  if $documentroot_owner == 'apache' {
+    $real_documentroot_owner = $::operatingsystem ? {
+      openbsd => 'www',
+      debian  => 'www-data',
+      default => $documentroot_owner
+    }
+  } else {
+    $real_documentroot_owner = $documentroot_owner
+  }
+  if $documentroot_group == 'apache' {
+    $real_documentroot_group = $::operatingsystem ? {
+      openbsd => 'www',
+      debian  => 'www-data',
+      default => $documentroot_group
+    }
+  } else {
+    $real_documentroot_group = $documentroot_group
+  }
+  case $ensure {
+    absent: {
+      exec{"cleanup_webdir_${real_path}":
+        command => "rm -rf ${real_path}",
+        onlyif  => "test -d  ${real_path}",
+        before  => File[$real_path],
+      }
+      file{$real_path:
+        ensure  => absent,
+        purge   => true,
+        recurse => true,
+        force   => true;
+      }
+    }
+    default: {
+      file{
+        $real_path:
+          ensure  => directory,
+          require => Anchor['apache::basic_dirs::ready'],
+          owner   => $real_owner,
+          group   => $real_group,
+          mode    => $real_mode;
+        $logdir:
+          ensure  => directory,
+          before  => Service['apache'],
+          owner   => $real_documentroot_owner,
+          group   => $real_documentroot_group,
+          mode    => '0660';
+        "${real_path}/private":
+          ensure  => directory,
+          owner   => $real_documentroot_owner,
+          group   => $real_documentroot_group,
+          mode    => '0600';
+      }
+      if $manage_docroot {
+        file{$documentroot:
+          ensure  => directory,
+          before  => Service['apache'],
+          recurse => $documentroot_recurse,
+          owner   => $real_documentroot_owner,
+          group   => $real_documentroot_group,
+          mode    => $documentroot_mode;
+        }
+      }
+      if $datadir {
+        file{"${real_path}/data":
+          ensure  => directory,
+          owner   => $real_documentroot_owner,
+          group   => $real_documentroot_group,
+          mode    => '0640';
+        }
+      }
+      case $::operatingsystem {
+        centos: { include apache::logrotate::centos::vhosts }
+        default: { #nothing
+        }
+      }
+    }
+  }
+}
+