added deployment file

docker/apache.conf

@@ -0,0 +1,42 @@
+ServerName localhost
+ServerTokens Prod
+ServerSignature Off
+TraceEnable Off
+
+# Only expose this HTTP listener to a trusted reverse proxy. The proxy must
+# overwrite X-Forwarded-Proto, not pass a client-supplied value through.
+# PHP uses HTTPS to decide whether participant/admin cookies need Secure.
+SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on
+
+<Directory /var/www/html>
+    Options -Indexes -MultiViews
+    AllowOverride None
+    DirectoryIndex index.php
+    Require all granted
+</Directory>
+
+# Internal code is still usable by PHP/CLI, never directly over HTTP.
+<DirectoryMatch "^/var/www/html/(?:includes|DB|dev|docker|dashboard/(?:tools|migrations))(?:/|$)">
+    Require all denied
+</DirectoryMatch>
+
+# Also deny dotfiles and backup/config files if accidentally added later.
+<LocationMatch "(?:^|/)\.">
+    Require all denied
+</LocationMatch>
+<FilesMatch "(?i)\.(?:sql(?:\.gz|\.zip)?|ini|env|toml|ya?ml|log|bak)$">
+    Require all denied
+</FilesMatch>
+
+Alias /healthz /usr/local/share/recruitment/health.php
+<Directory /usr/local/share/recruitment>
+    Options -Indexes
+    AllowOverride None
+    Require all denied
+    <Files health.php>
+        Require all granted
+    </Files>
+</Directory>
+
+Header always set X-Content-Type-Options "nosniff"
+Header always set Referrer-Policy "same-origin"