The "proper order" is as follows (crudely shortened):
- at least one <Directory/> block for every distinct file system location you want to access
- at least one main server or default virtual server block
- access restrictions can appear almost anywhere they make sense, i.e. inside any block that defines a document location of some sort.
So a simple config might look like this:
<Global config>
Holds general directives, ones that don't affect any documents, like logging, error handling, maximum values etc.
<Main server config>
The configuration for a single domain, i.e. what you would have without using virtualhosts.
This includes the topmost <Directory/> block, and its access controls (usually Deny All) and the main server document root.
<Virtual host config>
Every directive that can be used in the main server config can be used in a virtualhost as well, in addition to being able to specify the server ports for each group of virtualhosts.
IIRC you
have to specify the port for a virtualhost, since this will allow the virtualhost mechanism to discriminate between, say, plain http and secure https connections - which virtualhost should receive which request.
First, you have to define where the virtual hosts should listen for requests; this can only be done by specifying an IP
address,
never a name.
So your first line should be:
Code: Select all
NameVirtualHost aaa.bbb.ccc.ddd:80
Then you can define each virtualhost in reference to this, like so:
Code: Select all
<VirtualHost aaa.bbb.ccc.ddd:80>
ServerName music.antsmarching.net
DocumentRoot /home/www/whatever
</VirtualHost>
And last, you have to set the access permissions for this virtual host's files, as in:
Code: Select all
<Directory /home/www/whatever>
Order Allow, Deny
Allow From your.preferred.ip.addresses
</Directory>
Note what I've done here:
1. you
must define a NameVirtualHost by
address, not name.
2. The
ServerName determines the virtual hosts' domainname,
not the virtualhost definition.
3. The
Directory block holds the access controls
4. Access is controlled by allowing specific addresses, and denying everything else by default.
You may want to read
this explanation on the apache web site.
There are other combinations possible, but these are among the easiest - and they work...
Yes, it's complex, and almost infinitely flexible, but believe me, when you've used apache for a while you'll come to love the near limitless possibilities it offers
