43 lines
1.3 KiB
ApacheConf
43 lines
1.3 KiB
ApacheConf
ServerName localhost
|
|
ServerTokens Prod
|
|
ServerSignature Off
|
|
TraceEnable Off
|
|
|
|
# Only expose this HTTP listener to a trusted reverse proxy. The proxy must
|
|
# overwrite X-Forwarded-Proto, not pass a client-supplied value through.
|
|
# PHP uses HTTPS to decide whether participant/admin cookies need Secure.
|
|
SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on
|
|
|
|
<Directory /var/www/html>
|
|
Options -Indexes -MultiViews
|
|
AllowOverride None
|
|
DirectoryIndex index.php
|
|
Require all granted
|
|
</Directory>
|
|
|
|
# Internal code is still usable by PHP/CLI, never directly over HTTP.
|
|
<DirectoryMatch "^/var/www/html/(?:includes|DB|dev|docker|dashboard/(?:tools|migrations))(?:/|$)">
|
|
Require all denied
|
|
</DirectoryMatch>
|
|
|
|
# Also deny dotfiles and backup/config files if accidentally added later.
|
|
<LocationMatch "(?:^|/)\.">
|
|
Require all denied
|
|
</LocationMatch>
|
|
<FilesMatch "(?i)\.(?:sql(?:\.gz|\.zip)?|ini|env|toml|ya?ml|log|bak)$">
|
|
Require all denied
|
|
</FilesMatch>
|
|
|
|
Alias /healthz /usr/local/share/recruitment/health.php
|
|
<Directory /usr/local/share/recruitment>
|
|
Options -Indexes
|
|
AllowOverride None
|
|
Require all denied
|
|
<Files health.php>
|
|
Require all granted
|
|
</Files>
|
|
</Directory>
|
|
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set Referrer-Policy "same-origin"
|