Thanakorn
ae98dcdcdd
- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and app internals; security headers, HSTS over TLS, optional HTTPS redirect - uploads served through app/file.php to signed-in users only - Apache/PHP hardening config for the container (ServerTokens, expose_php) - least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php; SMTP passwords re-encrypted with a random IV (secret_box.php) - Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets - escape notification text; CLI guards on build scripts; no fixed demo password
23 lines
645 B
Plaintext
23 lines
645 B
Plaintext
# Apache hardening for the wms-app container.
|
|
|
|
# No version banners in headers or error pages.
|
|
ServerTokens Prod
|
|
ServerSignature Off
|
|
TraceEnable Off
|
|
|
|
# The repository is mounted under the web root; its .htaccess refuses .git, .env,
|
|
# deployment folders and app internals, so it must be honoured.
|
|
<Directory /var/www/html/wms-app>
|
|
Options -Indexes +FollowSymLinks
|
|
AllowOverride All
|
|
Require all granted
|
|
</Directory>
|
|
|
|
# Nothing else under the default web root is part of this app.
|
|
<Directory /var/www/html>
|
|
Options -Indexes
|
|
</Directory>
|
|
|
|
# FORCE_HTTPS from docker-compose is read by the .htaccess redirect rule.
|
|
PassEnv FORCE_HTTPS
|