29 lines
1.5 KiB
Plaintext
29 lines
1.5 KiB
Plaintext
 
|
## SECURITY: never serve config / VCS dotfiles over HTTP (standalone cac).
|
||
|
|
##
|
||
|
|
## Same named list as WHP's shared-httpd drop-in (web-files/configs/
|
||
|
|
## shared-httpd-security.conf, 000-whp-security.conf on every shared-httpd host),
|
||
|
|
## re-rooted from /mnt/users to /home because here the docroot is
|
||
|
|
## /home/<user>/public_html. Standalone cac never got that drop-in, and measured
|
||
|
|
## on .148 it served /.env with contents.
|
||
|
|
##
|
||
|
|
## <FilesMatch> matches the FILENAME resolved from the filesystem path, not the
|
||
|
|
## request URL, so it cannot be side-stepped by URL-encoding. httpd applies
|
||
|
|
## <Directory> sections (and .htaccess) first and <Files>/<FilesMatch> after
|
||
|
|
## them, so this deny wins over create-vhost.sh's `Require all granted`.
|
||
|
|
##
|
||
|
|
## A NAMED LIST, NOT A BLANKET "^\." DENY: /.well-known/ (ACME, security.txt,
|
||
|
|
## apple-app-site-association, assetlinks.json, payment-domain verification)
|
||
|
|
## must stay reachable. FilesMatch tests the final path component, and for
|
||
|
|
## /.well-known/acme-challenge/<token> that is <token>, not a dotfile.
|
||
|
|
##
|
||
|
|
## HTTP only: PHP still reads .user.ini and .env off the filesystem as before.
|
||
|
|
<Directory "/home">
|
||
|
|
<FilesMatch "^\.(user\.ini|env|git|svn|hg|bzr|ht|whp|site-builder)">
|
||
|
|
Require all denied
|
||
|
|
</FilesMatch>
|
||
|
|
</Directory>
|
||
|
|
## Directory form: reaches the files INSIDE .git/ etc. (e.g. /.git/config,
|
||
|
|
## whose own name is not a dotfile).
|
||
|
|
<DirectoryMatch "^/home/.*/\.(git|svn|hg|bzr|whp|site-builder)(/|$)">
|
||
|
|
Require all denied
|
||
|
|
</DirectoryMatch>
|