Yosemite Server: Apache shm errors with proxy_balancer | SASL errors using user alias

Question

Dear OSX Server Ninjas,
I recently upgraded my 10.9.5 Mac mini running Server 3.2.2 to Yosemite + Server v4, directly to v4.0.3. The box serves the whole Mail/Cal/Contacts/VPN palette as well as some websites, Git repos and some custom software. See below for network setup.
After battling the most blatant issues (some easy to fix but hard to find, others hard on both), I'm almost back to a working server setup … but some things keep bugging me even after days of log-reading and OD tricks. In the last days, I have read countless discussions here as well as on stackoverflow/serverfault/apple.stackexchange and blogs, so I'll try to be as thorough and precise as possible to show what I have tried so far – sorry in advance for the long post
… and since you might not read to the bottom: Thanks in advance for any help, especially with the Apache problem!
My setup
OSX Server v4.0.3 running on Yosemite 10.10.1 ➞ both latest official releases
host + DNS
Hostname configured for public domain mydomain.net, web traffic on selected ports comes in through router NAT
Server has a static IP on the local subnet 192.168.178.0/24
Server running local DNS and performing lookups for all clients in the local subnet, forwarding to the router at 192.168.178.1
Primary zone for mydomain.net with records (A, NS, MX) pointing to said static IP
changeip -checkhostname is successful
Public IP is currently configured at the domain registrar through his name servers
SSL
Trusted third-party certificate installed for host.mydomain.net (Common Name + SAN for two subdomains)
Used to secure all services
Qualys SSL Test Grade B (capped due to OSX's openssl 0.9.x not being capable of TLS1.2 and Intermediate CA SHA-1 )
TLS working both inbound and outbound according to CheckTLS.com
OpenDirectory
Recreated after upgrade (probably not necessary, since issue persists), re-imported groups + users from WGM backup files
Only the server itself is bound to the directory, other devices just access services through network accounts (CRAM-MD5, MD5-Digest)
Problems
Apache shm errors: Apache fails to create slot memory when proxy module is enabled
As soon as I start a service which requires the Apache proxy_balancer module (e.g. Cal/Contacts, ProfileManager), this starts filling up my Apache's error log:
[Mon Jan 12 01:41:17.979882 2015] [proxy_balancer:emerg] [pid 2949] (28)No space left on device: AH01179: balancer slotmem_create failed for p26d9e669--1011640492
[Mon Jan 12 01:41:17.979894 2015] [:emerg] [pid 2949] AH00020: Configuration Failed, exiting
[Mon Jan 12 01:41:28.297127 2015] [slotmem_shm:error] [pid 3026] (28)No space left on device: AH02611: create: apr_shm_create(/private/var/run/slotmem-shm-p26d9e669--1001322955.shm) failed
[Mon Jan 12 01:41:28.297347 2015] [proxy_balancer:emerg] [pid 3026] (28)No space left on device: AH01179: balancer slotmem_create failed for p26d9e669--1001322955
[Mon Jan 12 01:41:28.297355 2015] [:emerg] [pid 3026] AH00020: Configuration Failed, exiting
When I increase the Apache LogLevel to trace1, I get this as well:
[Mon Jan 12 02:11:43.190303 2015] [slotmem_shm:debug] [pid 5501] mod_slotmem_shm.c(367): AH02602: create didn't find /private/var/run/slotmem-shm-p26d9e669-813569972.shm in global list
This causes the Apache to crash constantly, which is … unnerving. After googling around for a while, I tried the following steps:
Stop Services that use the Apache (Web, *DAV, ProfileManager)
sudo apachectl stop
Remove all orphan cache/slot files (.shm, ssl-cache, proxy.*) from /private/var/run
Reboot the server
Start up the Services again
Curiously enough, this worked for a while! But I was getting several log messages about dropped proxy connections, and sometimes the ProfileManager page would time out. Then, the issue started to reappear and does not seem to be fixed again with the steps above. I looked through the Apache config files and config plists for the Services in question, as well as the default config files. The only thing I have so far is that as long as there are no active proxy connections, the Apache runs smoothly – but all goes awry when slotmem files are created (a lot of them). Sometimes, I am able to turn on the Calendar service, but switching on Contacts produces the error … one time, I even got Calendar + Contacts running, and all went well until I enabled Profile Manager.
I found several error reports with similar or identical errors from other Apache 2.4.x users, but most of those were developer talk on mailing lists, or suggested steps that did not work for me (or were inapplicable on the OS X Server Apache environment).
SASL errors using user alias for WebDAV-Digest authentication
Short version: I am unable to authenticate through WebDAV-Digest with a user's alias (defined in Server Admin > Users > Context Menu > Advanced Options or WGM). Using the main short name of the same user works flawlessly. Password Server Error log just shows:
AUTH2: {234023578237md5hash2384234, mainshortname} WEBDAV-DIGEST authentication failed, SASL error -13 (password incorrect).
The password is 100% correct: When I set up a test CalDAV account and put in alias+PW, it did not work (OS X Dialog showed “could not be verified”, Server log as above). Leaving the password field filled and just switching the user to the main short name went through instantaneously, with the Server log showing
AUTH2: {234023578237md5hash2384234, mainshortname} WEBDAV-DIGEST authentication succeeded.
Notice the same MD5 hash and canonical short name, yet different results. I don't know if this is a new “feature”, a result of mail aliases being handled differently (at least I read that somewhere) …
Additional Questions
Should I configure the DNS for public use, instead of the Split-Brain configuration (local network gets local IP, outside traffic is directed by registrar NS)? I read several articles explaining that Split-Brain is common in large organizations, but might introduce weird networking issues. Entering the external IP as a Round Robin alternative for the internal does not seem sensible to me.
I also have a question concerning LDAP log entries like this one below, but I'll put that in this already open discussion:
=> bdb_idl_delete_key: c_get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994)

Answer 1

Today the same error occurred on a customers server.
We don't use Calendar or Contacts.
We only have some websites configured and want use NetInstall for deployments.
As soon as I disable the Profilemanager the httpd starts over and other websites and NetInstall via HTTP are working fine.
When I reenable Profilemanager the httpd processes are gone and I see the same stuff in Apache's error log...