# Apache configuration for the PhaiDesk deployment.
#
# None of this is the security boundary — every endpoint checks its own authentication, and the
# agent gateway verifies a signature before it loads the database. It closes the gaps that are
# not endpoints at all: the directory listing, and the files that are data rather than code.

# A listing of this folder names install.php and upgrade.php and offers setup.sql for download.
Options -Indexes

# Data files. PHP is executed, so its source never goes over the wire; these would.
<FilesMatch "\.(sql|md|log|bak|old|ini|json|yml|yaml)$">
    Require all denied
</FilesMatch>

# Dotfiles, this one included.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# upgrade.php migrates a database in place and must be removed once it has run. Until somebody
# does, it is at least not reachable by guessing.
<Files "upgrade.php">
    Require ip 127.0.0.1 ::1
</Files>

# No version banner, no directory-listing content type games.
ServerSignature Off

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"
</IfModule>
