See doc/phpgw-apache.conf for a sample VirtualHost include.
A good phpgw app should only have access to /phpgroupware/index.php