Question

I’m looking for a way to manipulate the webserver PHP is running under, using APIs.

For example, I’d like to be able to add mod rewrite rules dynamically or block IP addresses for certain paths, all without touching .htaccess files.

Does something like this exist for PHP?

Answer 1

It is not possible for PHP to alter Apache’s config dynamically, although as you noted you can use PHP to edit the configuration or .htaccess files reload the configuration. But I would consider that a big security risk to give your webapp that much power over the web server.

Your example of blocking IPs dynamically can be done with mod_rewrite’s RewriteMap directive. Basically, you would write a mod_rewrite rule for your website that will instruct mod_rewrite to look in an external data source that your PHP script could maintain.

The mod_rewrite documentation has an example to start from: Denying Hosts in a Blacklist

Description:
We wish to maintain a blacklist of hosts, rather like hosts.deny,
and have those hosts blocked from accessing our server.

Solution:
RewriteEngine on
RewriteMap hosts-deny txt:/path/to/hosts.deny
RewriteCond ${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND} !=NOT-FOUND [OR]
RewriteCond ${hosts-deny:%{REMOTE_HOST}|NOT-FOUND} !=NOT-FOUND
RewriteRule ^ - [F]
##
## hosts.deny
##
## ATTENTION! This is a map, not a list, even when we treat it as such.
## mod_rewrite parses it for key/value pairs, so at least a
## dummy value "-" must be present for each entry.
##

193.102.180.41 -
bsdti1.sdm.de -
192.76.162.40 -

Discussion:
The second RewriteCond assumes that you have HostNameLookups turned on,
so that client IP addresses will be resolved. If that's not the case,
you should drop the second RewriteCond, and drop the [OR] flag from
the first RewriteCond.

Your PHP script could maintain those text files (other data stores are available, too) and you could make any number of rulesets for your specific needs to control access dynamically. Would that work?