What is best practice for using suEXEC on complex sites?
We've got a site running under a single vhost, and we want to be able to run different PHP web apps eg /forum /wiki /crm as their own UIDs, to help isolate any potential security threats.
I've used apache2 + mod_fastcgi + mod_suexec to split multiple sites to unique UIDs by vhost before. However, mod_suexec's SuexecUserGroup directive only works inside a <VirtualHost> block, and is not valid in a more specific <Directory> or <Location>
Is changing to lighttpd + suexec the only way to achieve this level of isolation without resorting to using a rewrite/proxy hack?