Individual directory options for every VirtualHost in Apache2

Question

I have a Debian 9 server with two static IPv4 addresses. One of them is public and the other one is in the server's VPN subnet (the machine is running an OpenVPN server).

There is a DNS server in the VPN subnet that handles internal name resolution with an own TLD. So both of these IPs have a domain name associated to them (let's call them public.domain and private.domain).

My Apache2 server has two VirtualHosts, one for each domain. There is a non-indexed subdirectory inside the document root that contains private data. What I want to do is password-protect this subdirectory when called from the public, but not require any authentication when accessed over the VPN address.

This is my public VirtualHost configuration:

<VirtualHost public.domain:443>

    [...]

    <Directory /path/to/private/directory>
        AuthType Basic
        AuthName "Private Data"
        AuthUserFile /etc/apache2/.htpasswd
        Require valid-user
    </Directory>

</VirtualHost>

And this is my private VirtualHost configuration:

<VirtualHost private.domain:443>

    [...]

    <Directory /path/to/private/directory>
        AuthType None
    </Directory>

</VirtualHost>

As it turns out, this configuration is not working properly:

• When I call the protected directory over public.domain, everything still works fine and I can authenticate normally.
• When I call it from private.domain I don't get asked for login credentials (which is what I wanted), but get a HTTP 403 Forbidden response (Which is obviously not what I wanted).

It seems like the <Directory> options in the two config files are interfering with each other. What am I doing wrong here? Or is this possible at all?

Many thanks in advance!

Answer 1

I just found a solution on my own.

I created two symlinks, both pointing to the desired folder. Then, I used one of them for the public VirtualHost and the other one for the private one. Works perfectly fine, just make sure to add Options FollowSymLinks in the <Directory> directives.