## SECURITY: never serve config / VCS dotfiles over HTTP (standalone cac).
##
## Same named list as WHP's shared-httpd drop-in (web-files/configs/
## shared-httpd-security.conf, 000-whp-security.conf on every shared-httpd host),
## re-rooted from /mnt/users to /home because here the docroot is
## /home/<user>/public_html. Standalone cac never got that drop-in, and measured
## on .148 it served /.env with contents.
##
## <FilesMatch> matches the FILENAME resolved from the filesystem path, not the
## request URL, so it cannot be side-stepped by URL-encoding. httpd applies
## <Directory> sections (and .htaccess) first and <Files>/<FilesMatch> after
## them, so this deny wins over create-vhost.sh's `Require all granted`.
##
## A NAMED LIST, NOT A BLANKET "^\." DENY: /.well-known/ (ACME, security.txt,
## apple-app-site-association, assetlinks.json, payment-domain verification)
## must stay reachable. FilesMatch tests the final path component, and for
## /.well-known/acme-challenge/<token> that is <token>, not a dotfile.
##
## HTTP only: PHP still reads .user.ini and .env off the filesystem as before.
<Directory "/home">
    <FilesMatch "^\.(user\.ini|env|git|svn|hg|bzr|ht|whp|site-builder)">
        Require all denied
    </FilesMatch>
</Directory>
## Directory form: reaches the files INSIDE .git/ etc. (e.g. /.git/config,
## whose own name is not a dotfile).
<DirectoryMatch "^/home/.*/\.(git|svn|hg|bzr|whp|site-builder)(/|$)">
    Require all denied
</DirectoryMatch>