My 2 cents:
Where are the RPMs going to come from? Are they Operating System Level RPMs or cPanel specific RPMs? If they are cPanel specific RPMs, then that means they would still have to pass through cPanel's Quality Assurance? I'm not sure what the gain is from the current system.
For example, when a new version of PHP is released, the first people that know about it are the folks over at php.net. If you compile your own PHP, it's a simple process of downloading the new PHP source package, and configure and compile on your server. With the curreny EA3 setup (correct me if I'm wrong) it may take a couple of days for the updated PHP package to make it's way into the EA3 system. Probably doesn't matter a whole lot, but if the new PHP fixes a major security flaw, those couple of days can be a lengthy time. RPMs, even from the OS vendors, can take a while to filter down as well.
I would be more interested in an EA4 that controls Apache and JUST Apache. Apache is a fairly mature product, it doesn't change a whole lot. Looking at the past release schedule, Apache 2.4.10 was released on July 19, 2014 and the next release, Apache 2.4.12 was released on January 27, 2014. That's a little over 6 months between releases.
PHP on the other hand, has pretty much fallen into a monthly release schedule. PHP 5.4.36 was released on December 18, 2014. PHP 5.4.37 was released on January 22, 2015. PHP upgrades are much more common. I don't think compiling PHP is that much of a hassle. Just save the ./configure line and that pretty much translate straight over from minor version to minor version (5.4.36 to 5.4.37...)
Apache modules, probably fall more in line with the Apache schedule. I'm not sure what the release schedule for something like mod_security is, but I don't think its monthly.
If you want to release something that allows EA4 to control everything, that's fine. But I would submit that I would rather have more modular control to the system. Being able to install Apache and ONLY Apache, and leaving control of Apache DSO modules to the server admin. If the server admin wants to install mod_security, they can compile it on their own, or if you want to include an RPM for that, that's fine too. If the server admin wants to install mod_cloudflare, they can compile it on their own, or install an included RPM. If the server admin wants to install suphp, they can compile it on their own or install an RPM. If the server admin wants to roll their own PHP, they can do so, or install an RPM. If the server admin wants to install a 3rd party Apache module that isn't listed in EasyApache, they can roll their own and compile it themselves.
I understand asking the community for what they "commonly" install, but you can't go around including every tiny module because 1 person wants it. If only 1 person is wanting to install a mod_fakeapachecrash module, then it's a waste of resources (IMHO) for cPanel developers to spend time getting that module included and keeping it maintained in EasyApache.
If you have to have specific controls, for example suPHP. The EasyApache system may need to be able to tell cPanel/WHM that suPHP is installed to set the VirtualHost template accordingly (or just allow direct editing of the VirtualHost templates). Then I would submit that having an option of "I will roll my own" as being a configuration option, which will effectively enable it in the EasyApache/cPanel/WHM schematic, but won't actually compile or install it. The admin would be left to install it on their own.
i.e.:
Do you want to install suPHP?
- Yes
- No
- I will roll my own
Which Version of PHP do you want to install?
- PHP 5.6.5
- PHP 5.5.21
- PHP 5.4.37
- I will roll my own
Configuration Control
Would the cPanel/WHM tie into Apache be better served by using an Include for the VirtualHost aspect? I've never really understood the whole distilling system for cPanel's Apache. I come from a background where modifying the configuration files by hand was common. I remember the days when there was no such thing as a Control Panel. If you wanted to increase the Max Clients for Apache, you modified the apache configuration file with a larger Max Clients value. But with cPanel you have to make the change and then distill it, so cPanel can remember that change? Or something like that.
It is my understanding that when you create a new account in the WHM or create a new addon or subdomain in the cPanel, that a new VirtualHost is added to the httpd.conf file. So basically, all cPanel/WHM does is add and delete VirtualHosts. Why not just have WHM/cPanel create those VirtualHosts in a secondary file (i.e. /usr/local/apache/conf/includes/virtualhosts.conf) and then in the main httpd.conf file have a line:
Include "/usr/local/apache/conf/includes/virtualhosts.conf"
This would free up server admins to be able to modify the configuration variables in the httpd.conf file as they see fit. If you want to still have a Tweak Apache place in the WHM, that's fine too, but have those changes saved into a file like /usr/local/apache/conf/includes/whm_apache_tweak.conf) and include it in the httpd.conf file. Basically, cPanel/WHM would never directly touch the httpd.conf file only files that might be included. This way, if someone wants to change a configuration variable that is not settable in the Tweak Apache WHM area, they can do so by directly editing the httpd.conf file or using their own Includes.
I get that having Apache controls (and this actually extends into other services, like Exim and PureFTP) within the WHM makes it easier for some people to get a handle of. But it takes control away from server admins that may want a more advanced approach or more control.