UPD: i like it now.

container-filesystem/etc/httpd/conf.d/application.conf

@@ -0,0 +1,18 @@
+WSGIDaemonProcess wsgi-daemon display-name=wsgi-daemon python-home=/srv/application/python python-path=/srv/application/django
+
+Alias /static/ "/srv/application/django/var/www/static/"
+<Directory "/srv/application/django/var/www/static">
+    AllowOverride None
+    Require all granted
+</Directory>
+
+WSGIScriptAlias / "/srv/application/django/main/wsgi.py"
+<Directory "/srv/application/django/main">
+    WSGIProcessGroup wsgi-daemon
+    WSGIPassAuthorization On
+    AllowOverride None
+    Options FollowSymLinks
+    <Files wsgi.py>
+        Require all granted
+    </Files>
+</Directory>

container-filesystem/etc/httpd/conf.d/defaults.conf

@@ -0,0 +1,4 @@
+# /etc/httpd/conf.d/defaults.conf
+
+ServerTokens Prod
+ErrorLog /dev/stderr

container-filesystem/etc/httpd/conf.d/wsgi.conf

@@ -0,0 +1 @@
+WSGISocketPrefix run/wsgi

container-filesystem/etc/httpd/conf.d/zzz-lock-down.conf

@@ -0,0 +1,15 @@
+# /etc/httpd/conf.d/zzz-lock-down.conf
+
+<Directory "/var/www">
+    Require all denied
+</Directory>
+<Directory "/var/www/html">
+    Require all denied
+</Directory>
+<Directory "/var/www/cgi-bin">
+    Require all denied
+</Directory>
+<Directory "/usr/share/httpd/icons">
+    Require all denied
+</Directory>
+