Installing/configurate Symfony3.2 on a Vhost Ubuntu subdomain folder --> Error 403 Forbidden and Error 500 - apache

Question

I try to install Symfony3.2 on my vhost, running Plesk under ubuntu.
My goal is to create a production-server-status to test my Symfony-projects online.
I want to get to this project using the URL subexample.example.tld or subexample.example.tld/matchGen.
On my journey through the cavern of tears and everlasting self-doubt, I saw a lot of different errors and even achieved to break the whole vhost down including my email system... great job.
Well.. now I got the error 403 Forbidden.
The good news (at least for me): I see the favicon of symfony and if I try to open the app_dev.php (subexample.example.tld/matchGen/web/app_dev.php) it will say You are not allowed to access this file. Check app_dev.php for more information..
Opening the app.php with subexample.example.tld/matchGen/web/app.phpresult in a redirect to subexample.example.tld/matchGen/web/ and The server returned a "500 Internal Server Error"..
subexample.example.tld runs into Forbidden, too.
I already tried/did the following:
New Install at a different location
PHP matchGen/bin/symfony_requirements --> [OK] Your system is ready to run Symfony projects
Using this as Guide http://symfony.com/doc/current/setup/web_server_configuration.html#web-server-apache-mod-php (Apache 2.4 - FastCGI)--> created my subexample.example.tld.conf in /etc/apache2/sites-available, used a2ensite subexample.example.tld.conf and service apache2 reload --> * Reloading web server apache2, apparently no problems.
I tried to use a different directory for the web folder and all the other stuff --> changed nothing
Changing the rights with chmod and chown --> well... now I know how to apply a backup... long story short --> I was way too naive and learned a valuable lesson with Ubuntu and the change of rights.
https://www.liquidweb.com/kb/apache-error-no-matching-directoryindex-index-html-found-solved/ --> No effect.
Now for the error.logs:
/var/www/vhosts/system/subexample.example.tld/logs/error_logs
[Mon Apr 10 20:41:45.361150 2017] [autoindex:error] [pid 15012] [client 87.147.219.10:5188] AH01276: Cannot serve directory /var/www/vhosts/example.tld/subexample.example.tld/: No matching DirectoryIndex (index.html,index.php) found, and server-generated directory index forbidden by Options directive
[Mon Apr 10 20:41:47.707623 2017] [autoindex:error] [pid 15012] [client 87.147.219.10:5188] AH01276: Cannot serve directory /var/www/vhosts/example.tld/subexample.example.tld/matchGen/: No matching DirectoryIndex (index.html,index.php) found, and server-generated directory index forbidden by Options directive
/var/log/apache2/matchGen_error.log and /var/log/apache2/matchGen_access.log are empty.
My configfiles:
/etc/apache2/sites-available/subexample.example.tld.conf
<VirtualHost *:80>
ServerName subexample.example.tld
ServerAlias www.subexample.example.tld
DocumentRoot /var/www/vhosts/example.tld/subexample.example.tld/matchGen/web
<Directory /var/www/vhosts/example.tld/subexample.example.tld/matchGen/web>
AllowOverride None
Require all granted
Allow from All
<IfModule mod_rewrite.c>
Options -MultiViews
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ app.php [QSA,L]
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>
</Directory>
# uncomment the following lines if you install assets as symlinks
# or run into problems when compiling LESS/Sass/CoffeeScript assets
# <Directory /var/www/project>
# Options FollowSymlinks
# </Directory>
# optionally disable the RewriteEngine for the asset directories
# which will allow apache to simply reply with a 404 when files are
# not found instead of passing the request into the full symfony stack
<Directory /var/www/vhosts/example.tld/subexample.example.tld/matchGen/web/bundles>
<IfModule mod_rewrite.c>
RewriteEngine Off
</IfModule>
</Directory>
ErrorLog /var/log/apache2/matchGen_error.log
CustomLog /var/log/apache2/matchGen_access.log combined
</VirtualHost>
/var/www/vhosts/system/subexample.example.tld/conf/httpd.conf
#ATTENTION!
#
#DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY,
#SO ALL YOUR CHANGES WILL BE LOST THE NEXT TIME THE FILE IS GENERATED.
#IF YOU REQUIRE TO APPLY CUSTOM MODIFICATIONS, PERFORM THEM IN THE FOLLOWING FILES:
#/var/www/vhosts/system/subexample.example.tld/conf/vhost.conf
#/var/www/vhosts/system/subexample.example.tld/conf/vhost_ssl.conf
<IfModule mod_ssl.c>
<VirtualHost xx.xx.xxx.xxx:443 >
ServerName "subexample.example.tld:443"
ServerAlias "www.subexample.example.tld"
ServerAlias "ipv4.subexample.example.tld"
ServerAdmin "root#example.tld"
UseCanonicalName Off
DocumentRoot "/var/www/vhosts/example.tld/subexample.example.tld"
CustomLog /var/www/vhosts/system/subexample.example.tld/logs/access_ssl_log plesklog
ErrorLog "/var/www/vhosts/system/subexample.example.tld/logs/error_log"
<IfModule mod_suexec.c>
SuexecUserGroup "xxxx" "xxxx"
</IfModule>
<IfModule mod_userdir.c>
UserDir "/var/www/vhosts/example.tld/web_users"
</IfModule>
<IfModule mod_sysenv.c>
SetSysEnv PP_VHOST_ID "6a66d04f-d22f-4a30-bb80-ca47f117886a"
</IfModule>
ScriptAlias "/cgi-bin/" "/var/www/vhosts/example.tld/subexample.example.tld/cgi-bin/"
Alias "/plesk-stat" "/var/www/vhosts/system/subexample.example.tld/statistics"
<Location /plesk-stat/>
Options +Indexes
</Location>
<Location /plesk-stat/logs/>
Require valid-user
</Location>
Alias /webstat /var/www/vhosts/system/subexample.example.tld/statistics/webstat
Alias /webstat-ssl /var/www/vhosts/system/subexample.example.tld/statistics/webstat-ssl
Alias /ftpstat /var/www/vhosts/system/subexample.example.tld/statistics/ftpstat
Alias /anon_ftpstat /var/www/vhosts/system/subexample.example.tld/statistics/anon_ftpstat
Alias /awstats-icon /usr/share/awstats/icon
SSLEngine on
SSLVerifyClient none
SSLCertificateFile /opt/psa/var/certificates/certyKQzXqX
SetEnv PP_CUSTOM_PHP_INI /var/www/vhosts/system/subexample.example.tld/etc/php.ini
SetEnv PP_CUSTOM_PHP_CGI_INDEX fastcgi
<IfModule mod_fcgid.c>
FcgidInitialEnv PP_CUSTOM_PHP_INI /var/www/vhosts/system/subexample.example.tld/etc/php.ini
FcgidInitialEnv PP_CUSTOM_PHP_CGI_INDEX fastcgi
FcgidMaxRequestLen 134217728
FcgidIOTimeout 600
</IfModule>
TimeOut 600
<Directory /var/www/vhosts/example.tld/subexample.example.tld>
<IfModule mod_fcgid.c>
<Files ~ (\.fcgi$)>
SetHandler fcgid-script
Options +ExecCGI
</Files>
</IfModule>
<IfModule mod_fcgid.c>
<Files ~ (\.php$)>
SetHandler fcgid-script
FCGIWrapper /var/www/cgi-bin/cgi_wrapper/cgi_wrapper .php
Options +ExecCGI
</Files>
</IfModule>
SSLRequireSSL
Options -Includes +ExecCGI
</Directory>
<Directory /var/www/vhosts/example.tld/web_users>
<IfModule mod_php4.c>
php_admin_flag engine off
</IfModule>
<IfModule mod_php5.c>
php_admin_flag engine off
</IfModule>
</Directory>
<Directory /var/www/vhosts/subexample.example.tld>
Options +FollowSymLinks
</Directory>
<Directory "/var/www/vhosts/system/subexample.example.tld/statistics">
AuthType Basic
AuthName "Domainstatistiken"
AuthUserFile "/var/www/vhosts/system/subexample.example.tld/pd/d..httpdocs#plesk-stat"
require valid-user
</Directory>
<IfModule mod_security2.c>
</IfModule>
</VirtualHost>
</IfModule>
<VirtualHost xx.xx.xxx.xxx:80 >
ServerName "subexample.example.tld:80"
ServerAlias "www.subexample.example.tld"
ServerAlias "ipv4.subexample.example.tld"
ServerAdmin "root#example.tld"
UseCanonicalName Off
DocumentRoot "/var/www/vhosts/example.tld/subexample.example.tld"
CustomLog /var/www/vhosts/system/subexample.example.tld/logs/access_log plesklog
ErrorLog "/var/www/vhosts/system/subexample.example.tld/logs/error_log"
<IfModule mod_suexec.c>
SuexecUserGroup "xxxx" "xxxx"
</IfModule>
<IfModule mod_userdir.c>
UserDir "/var/www/vhosts/example.tld/web_users"
</IfModule>
<IfModule mod_sysenv.c>
SetSysEnv PP_VHOST_ID "6a66d04f-d22f-4a30-bb80-ca47f117886a"
</IfModule>
ScriptAlias "/cgi-bin/" "/var/www/vhosts/example.tld/subexample.example.tld/cgi-bin/"
Redirect permanent /plesk-stat https://subexample.example.tld/plesk-stat
Redirect permanent /webstat https://subexample.example.tld/webstat
Redirect permanent /webstat-ssl https://subexample.example.tld/webstat-ssl
Redirect permanent /ftpstat https://subexample.example.tld/ftpstat
Redirect permanent /anon_ftpstat https://subexample.example.tld/anon_ftpstat
Redirect permanent /awstats-icon https://subexample.example.tld/awstats-icon
<IfModule mod_ssl.c>
SSLEngine off
</IfModule>
SetEnv PP_CUSTOM_PHP_INI /var/www/vhosts/system/subexample.example.tld/etc/php.ini
SetEnv PP_CUSTOM_PHP_CGI_INDEX fastcgi
<IfModule mod_fcgid.c>
FcgidInitialEnv PP_CUSTOM_PHP_INI /var/www/vhosts/system/subexample.example.tld/etc/php.ini
FcgidInitialEnv PP_CUSTOM_PHP_CGI_INDEX fastcgi
FcgidMaxRequestLen 134217728
FcgidIOTimeout 600
</IfModule>
TimeOut 600
<Directory /var/www/vhosts/example.tld/subexample.example.tld>
<IfModule mod_fcgid.c>
<Files ~ (\.fcgi$)>
SetHandler fcgid-script
Options +ExecCGI
</Files>
</IfModule>
<IfModule mod_fcgid.c>
<Files ~ (\.php$)>
SetHandler fcgid-script
FCGIWrapper /var/www/cgi-bin/cgi_wrapper/cgi_wrapper .php
Options +ExecCGI
</Files>
</IfModule>
Options -Includes +ExecCGI
</Directory>
<Directory /var/www/vhosts/example.tld/web_users>
<IfModule mod_php4.c>
php_admin_flag engine off
</IfModule>
<IfModule mod_php5.c>
php_admin_flag engine off
</IfModule>
</Directory>
<Directory /var/www/vhosts/subexample.example.tld>
Options +FollowSymLinks
</Directory>
<Directory "/var/www/vhosts/system/subexample.example.tld/statistics">
AuthType Basic
AuthName "Domainstatistiken"
AuthUserFile "/var/www/vhosts/system/subexample.example.tld/pd/d..httpdocs#plesk-stat"
require valid-user
</Directory>
<IfModule mod_security2.c>
</IfModule>
</VirtualHost>
Well, I think that should give you the idea of my problem.
Thank you in advance!
Ah... please explain it for dummies... I know some things... but apparently not enough.
Edit 1:
I tried again to change the rights...
This time I created a new group, put my matchGen folder in it and tried to allow everything in this group.
sudo addgroup Symfony --force-badname
Allowing use of questionable username.
Adding group `Symfony' (GID 1009) ...
Done.
sudo chown root.Symfony /var/www/vhosts/example.tld/subexample.example.tld/matchGen -R
chmod g+rwx /var/www/vhosts/example.tld/subexample.example.tld/matchGen
No change.
Oh.. and I added the user www-data to the group Symfony.
Edit 2:
I tried to work with http://symfony.com/doc/current/setup/web_server_configuration.html#web-server-apache-fpm, but nothing changed.
After the reset I tried to open subexample.example.tld/matchGen/web/ again.
Well it did not work, but this time the error seemed to be different HTTP ERROR 500.
So... after looking in the Looks again --> mod_fcgid: stderr: PHP Fatal error: Uncaught exception 'UnexpectedValueException' with message 'The stream or file "/var/www/vhosts/example.tld/subexample.example.tld/matchGen/var/logs/prod.log" could not be opened: failed to open stream: Permission denied' in /var/www/vhosts/example.tld/subexample.example.tld/matchGen/var/cache/prod/classes.php:8203
It is definitely a problem with the rights. But why will it not work?
...
I tried to setup the www-data-user with acl, using this guide --> http://symfony.com/doc/current/setup/file_permissions.html#using-acl-on-a-system-that-supports-setfacl-linux-bsd
Instead of using var or /var at the end of the setfacl-command I used matchGen as a folder.
No change.
Edit 3:
I did it!
This here helped me after i reached the point after Edit 2.
'Failed to open stream: Permission denied' error - Laravel
Go in your project folder and use php bin/console cache:clear --env=prod
Follow up with chmod -R 777 var
Finish with composer dump-autoload
Finally...

Answer 1

Here is a list of things you should check if you got the same problem:
run php bin/symfony_requirements in your project folder. You may need to set up the timezone in your php.ini
create and activate a config/site for your subdomain in /etc/apache2/site-available and use a2ensite subexample.example.tld.conf. Be sure to end the name with .conf when creating the file.
Before you create/change the rights use php bin/console cache:clear --env=prod in your project folder, then set them for your var folder with chmod -R 777 var. Finish it in your project folder with composer dump-autoload.