put it in conf-enabled/mock-ipa.conf and grab wsgi.py from freeipa-server. Processes is normally =2, and that's enough to reproduce the bug when the full ipa server is installed, but for demonstration purposed this config will do (plus a2enmod wsgi of course).
So it's freeipa-server apache config that causes it, not mod_nss. Turns out it's mod_wsgi, this is enough to reproduce the failure:
WSGISocketPrefix /run/apache2/wsgi requests= 500 Group ipa ipa/wsgi. py process-group=ipa application- group=ipa
WSGIDaemonProcess ipa processes=6 threads=1 maximum-
WSGIProcessGroup ipa
WSGIApplication
WSGIImportScript /usr/share/
put it in conf-enabled/ mock-ipa. conf and grab wsgi.py from freeipa-server. Processes is normally =2, and that's enough to reproduce the bug when the full ipa server is installed, but for demonstration purposed this config will do (plus a2enmod wsgi of course).