'\" t
.\"     Title: httpd.service
.\"    Author: Joe Orton <jorton@redhat.com>
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
.\"      Date: 02/03/2026
.\"    Manual: httpd systemd units
.\"    Source: httpd
.\"  Language: English
.\"
.TH "HTTPD\&.SERVICE" "8" "02/03/2026" "httpd" "httpd systemd units"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
httpd.service, httpd@.service, httpd.socket, httpd-init.service \- httpd unit files for systemd
.SH "SYNOPSIS"
.PP
/usr/lib/systemd/system/httpd\&.service,
/usr/lib/systemd/system/httpd@\&.service,
/usr/lib/systemd/system/httpd\-init\&.service,
/usr/lib/systemd/system/httpd\&.socket
.SH "DESCRIPTION"
.PP
This manual page describes the
\fBsystemd\fR
unit files used to integrate the
\fBhttpd\fR
daemon with
\fBsystemd\fR\&. Two main unit files are available:
\fBhttpd\&.service\fR
allows the
\fBhttpd\fR
daemon to be run as a system service, and
\fBhttpd\&.socket\fR
allows httpd to be started via socket\-based activation\&. Most systems will use
\fBhttpd\&.service\fR\&.
.PP
The
\fBapachectl\fR
command has been modified to invoke
\fBsystemctl\fR
for most uses, so for example, running
\fBapachectl start\fR
is equivalent to running
\fBsystemctl start httpd\&.service\fR\&. This ensures that the running httpd daemon is tracked and managed by
\fBsystemd\fR\&. In contrast, running
\fBhttpd\fR
directly from a root shell will start the service outside of
\fBsystemd\fR; in this case, default security restrictions described below (including, but not limited to, SELinux) will not be enforced\&.
.SS "Changing default behaviour"
.PP
To change the default behaviour of the httpd service, an
\fIover\-ride\fR
file should be created, rather than changing
/usr/lib/systemd/system/httpd\&.service
directly, since such changes would be lost over package upgrades\&. Running
\fBsystemctl edit httpd\&.service\fR
or
\fBsystemctl edit httpd\&.socket\fR
as root will create a drop\-in file (in the former case, in
/etc/systemd/system/httpd\&.service\&.d) which over\-rides the system defaults\&.
.PP
For example, to set the
\fBLD_LIBRARY_PATH\fR
environment variable for the daemon, run
\fBsystemctl edit httpd\&.service\fR
and enter:
.sp
.if n \{\
.RS 4
.\}
.nf
[Service]
Environment=LD_LIBRARY_PATH=/opt/vendor/lib
.fi
.if n \{\
.RE
.\}
.SS "Starting the service at boot time"
.PP
The httpd\&.service and httpd\&.socket units are
\fIdisabled\fR
by default\&. To start the httpd service at boot time, run:
\fBsystemctl enable httpd\&.service\fR\&. In the default configuration, the httpd daemon will accept connections on port 80 (and, if mod_ssl is installed, TLS connections on port 443) for any configured IPv4 or IPv6 address\&.
.PP
If httpd is configured to depend on any specific IP address (for example, with a "Listen" directive) which may only become available during start\-up, or if httpd depends on other services (such as a database daemon), the service
\fImust\fR
be configured to ensure correct start\-up ordering\&.
.PP
For example, to ensure httpd is only running after all configured network interfaces are configured, create a drop\-in file (as described above) with the following section:
.sp
.if n \{\
.RS 4
.\}
.nf
[Unit]
After=network\-online\&.target
Wants=network\-online\&.target
.fi
.if n \{\
.RE
.\}
.sp
See
\m[blue]\fB\%https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/\fR\m[]
for more information on start\-up ordering with systemd\&.
.SS "SSL/TLS certificate generation"
.PP
The
\fBhttpd\-init\&.service\fR
unit is provided with the mod_ssl package\&. This oneshot unit automatically creates a TLS server certificate and key (using a generated self\-signed CA certificate and key) for testing purposes before httpd is started\&. To inhibit certificate generation, use
\fBsystemctl mask httpd\-init\&.service\fR
after installing mod_ssl, and adjust the mod_ssl configuration to use an appropriate certificate and key\&.
.SS "Reloading and stopping the service"
.PP
When running
\fBsystemctl reload httpd\&.service\fR, a
\fIgraceful\fR
restart is used, which sends a signal to the httpd parent process to reload the configuration and re\-open log files\&. Any children with open connections at the time of reload will terminate only once they have completed serving requests\&. This prevents users of the server seeing errors (or potentially losing data) due to the reload, but means some there is some delay before any configuration changes take effect for all users\&.
.PP
Similarly, a
\fIgraceful stop\fR
is used when
\fBsystemctl stop httpd\&.service\fR
is run, which terminates the server only once active connections have been processed\&.
.PP
To "ungracefully" stop the server without waiting for requests to complete, use
\fBsystemctl kill \-\-kill\-who=main httpd\fR; similarly to "ungracefully" reload the configuration, use
\fBsystemctl kill \-\-kill\-who=main \-\-signal=HUP httpd\fR\&.
.SS "Automated service restarts"
.PP
System packages (including the httpd package itself) may restart the httpd service automatically after packages are upgraded, installed, or removed\&. This is done using the
\fBsystemctl try\-restart httpd\&.service\fR
command, which stops then starts the service if it is running\&.
.PP
To disable automatic restarts, create the file
/etc/sysconfig/httpd\-disable\-posttrans\&. When
\fBhttpd\fR
interfaces are added in an update, it may not be safe to
\fIreload\fR
a running service after upgrading, if updated modules require interfaces only available in the updated
\fBhttpd\fR
binary\&. It is recommended to allow automatic restarts for this reason\&.
.SS "Changing the default MPM (Multi\-Processing Module)"
.PP
httpd offers a choice of multi\-processing modules (MPMs), which can be configured in
/etc/httpd/conf\&.modules\&.d/00\-mpm\&.conf\&. See
\fBhttpd.conf\fR(5)
for more information on changing the MPM\&.
.SS "systemd integration and mod_systemd"
.PP
The httpd service uses the
\fBnotify\fR
systemd service type\&. The
mod_systemd
module must be loaded (as in the default configuration) for this to work correctly \- the service will fail if this module is not loaded\&.
mod_systemd
also makes worker and request statistics available when running
\fBsystemctl status httpd\fR\&. See
\fBsystemd.exec\fR(5)
for more information on systemd service types\&.
.SS "Security and SELinux"
.PP
The default SELinux policy restricts the httpd service in various ways\&. For example, the default policy limits the ports to which httpd can bind (using the
Listen
directive), which parts of the filesystem can be accessed, and whether outgoing TCP connections are possible\&. Many of these restrictions can be relaxed or adjusted by using
\fBsemanage\fR
to change booleans or other types\&. See
\fBhttpd_selinux\fR(8)
for more information\&.
.SS "Process policies and restrictions"
.PP
The
\fBhttpd\&.service\fR
unit enables a variety of sandboxing options\&. Many of these prevent the service from changing the system configuration or attributes of the kernel \- such as
\fIProtectClock\fR
and
\fIProtectKernelModules\fR\&. See
\fBsystemd.exec\fR(5)
and
\fBsystemd.service\fR(5)
for more information on these options\&. Particular notice should be taken of the following:
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fIPrivateTmp\fR
is enabled by default\&. The
/tmp
and
/var/tmp
directories available within the httpd process (and CGI scripts, etc) are not shared by other processes\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fIOOMPolicy\fR
is set to
\fIcontinue\fR
by default\&. Under the default Out\-of\-Memory policy, the entire service will be terminated if any process is killed by the kernel OOM killer\&. By setting the policy to
\fIcontinue\fR, httpd will continue to run (and recover) if a single child is terminated because of excess memory consumption\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fIProtectHome\fR
is set to
\fIread\-only\fR
by default\&. CGI scripts run via
\fIUserDir\fR
will not be able modify any content in
/home
by default\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fIProtectSystem\fR
is set to
\fIyes\fR
by default; this mounts various system paths like
/usr
and
/boot
as read\-only by default\&.
.RE
.SS "Logging and log file rotation"
.PP
The
\fBhttpd\fR
daemon is configured to log to the
/var/log/httpd
directory by default, and a drop\-in for
\fBlogrotate\fR
is provided at
/etc/logrotate\&.d/httpd
to enable log file rotation\&. The
\fBhttpd\&.service\fR
systemd unit is reloaded after a
\fBlogrotate\fR
run\&.
.PP
Log file compression is not enabled by default; since
\fBhttpd\fR
can continue writing to open log files for some time after a reload (graceful restart), if compression is enabled the
delaycompress
option must be present (as in the default) to delay compression of log files to a later rotation run\&.
.SS "Socket activation"
.PP
Socket activation (see
\fBsystemd.socket\fR(5)
for more information) can be used with
\fBhttpd\fR
by enabling the
\fBhttpd\&.socket\fR
unit\&. The
\fBhttpd\fR
listener configuration must exactly match the
ListenStream
options configured for the
\fBhttpd\&.socket\fR
unit\&. The default
\fBhttpd\&.socket\fR
has a
ListenStream=80
and, if mod_ssl is installed,
ListenStream=443
by a drop\-in file\&. If additional
Listen
directives are added to the httpd configuration, corresponding
ListenStream
options should be added via drop\-in files, for example via
\fBsystemctl edit httpd\&.socket\fR\&.
.PP
If using socket activation with httpd, only one listener on any given TCP port is supported; a configuration with both "Listen 127\&.0\&.0\&.1:80" and "Listen 192\&.168\&.1\&.2:80" will not work\&.
.SS "Instantiated services"
.PP
The
\fBhttpd@\&.service\fR
unit is a template for creating instantiated services\&. An instance of this unit will be started using the configuration file
/etc/httpd/conf/INSTANCE\&.conf, where
\fIINSTANCE\fR
is replaced with the instance name\&. For example,
\fBsystemctl start httpd@foobar\&.service\fR
will start httpd using the configuration file
/etc/httpd/conf/foobar\&.conf\&. The
\fBHTTPD_INSTANCE\fR
environment variable is set to the instance name by the unit and is available for use within the configuration file\&.
.PP
To allow multiple instances of httpd to run simultaneously, a number of configuration directives must be changed, such as
\fBPidFile\fR
and
\fBDefaultRuntimeDir\fR
to pick non\-conflicting paths, and
\fBListen\fR
to choose different ports\&. The example configuration file
/usr/share/doc/httpd/instance\&.conf
demonstrates how to make such changes using the
\fBHTTPD_INSTANCE\fR
variable\&.
.PP
It can be useful to configure instances of
\fBhttpd@\&.service\fR
to reload when
\fBhttpd\&.service\fR
is reloaded; for example,
\fBlogrotate\fR
will reload only
\fBhttpd\&.service\fR
when logs are rotated\&. If this behaviour is required, create a drop\-in file for the instance as follows:
.sp
.if n \{\
.RS 4
.\}
.nf
[Unit]
ReloadPropagatedFrom=httpd\&.service
.fi
.if n \{\
.RE
.\}
.sp
As with normal units, drop\-in files for instances can be created using
\fBsystemctl edit\fR, e\&.g\&.
\fBsystemctl edit httpd@foobar\&.service\fR\&.
.SH "FILES"
.PP
/usr/lib/systemd/system/httpd\&.service,
/usr/lib/systemd/system/httpd\&.socket,
/usr/lib/systemd/system/httpd@\&.service,
/etc/systemd/systemd/httpd\&.service\&.d
.SH "REPORTING BUGS"
.PP
Please report bugs by filing an issue in https://bugzilla\&.redhat\&.com/\&.
.SH "SEE ALSO"
.PP
\fBhttpd\fR(8),
\fBhttpd.conf\fR(5),
\fBsystemd\fR(1),
\fBsystemctl\fR(1),
\fBsystemd.service\fR(5),
\fBsystemd.exec\fR(5),
\fBsystemd.socket\fR(5),
\fBhttpd_selinux\fR(8),
\fBsemanage\fR(8),
\fBlogrotate\fR(8)
.SH "AUTHOR"
.PP
\fBJoe Orton\fR <\&jorton@redhat\&.com\&>
.RS 4
Author
.RE
