Init Git Prod Mars 2026

2026-03-05 10:25:39 +01:00
commit d81efe93b1
@@ -0,0 +1,85 @@
+# --- Sécurité : en-têtes globaux ---
+<IfModule mod_headers.c>
+  Header always set X-Content-Type-Options "nosniff"
+  Header always set X-Frame-Options "DENY"
+  Header always set Referrer-Policy "strict-origin-when-cross-origin"
+  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
+  Header always set Cross-Origin-Opener-Policy "same-origin"
+  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+  # CSP en observation (ne bloque rien pour l’instant)
+# --- CSP (global) : autorise Matomo + CDNs ---
+Header always set Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https: https://staging.uslugi.fr/matomo/; script-src 'self' 'unsafe-inline' https://staging.uslugi.fr/matomo/ https://cdn.jsdelivr.net https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-ancestors 'none'"
+
+</IfModule>
+
+# Réduire surface d’attaque
+Options -Indexes -MultiViews
+
+# --- Réécriture & HTTPS ---
+RewriteEngine On
+
+# Forcer HTTPS (OK derrière proxy/Varnish)
+RewriteCond %{HTTPS} !=on
+RewriteCond %{HTTP:X-Forwarded-Proto} !https
+RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
+
+# Laisser passer Let's Encrypt
+RewriteRule ^\.well-known/acme-challenge/ - [L]
+
+# --- Protection chemins & fichiers sensibles ---
+# Bloquer VCS
+RewriteRule ^(\.git|\.svn|\.hg)(/|$) - [F]
+# Bloquer dotfiles (sauf .well-known)
+RewriteRule ^\.(?!well-known/) - [F]
+# Bloquer extensions sensibles
+RewriteRule \.(env|ini|log|bak|old|sql|zip|tar|gz|7z)$ - [F]
+# Bloquer fichiers sauvegardes *~
+RewriteRule ^(.*/)?[^/]+~$ - [F]
+# Bloquer certains noms explicites
+<FilesMatch "^(config\.php|config\.sample\.php|composer\.json|composer\.lock|package\.json|yarn\.lock)$">
+  Require all denied
+</FilesMatch>
+# Ceinture+bretelles : jamais de scripts dans /uploads
+RewriteRule ^(?:public/)?uploads/.*\.(php|phtml|phar|phps|cgi|pl|py|sh|rb)$ - [F,NC]
+
+# --- Routage applicatif ---
+# 0) Servir les fichiers/dirs existants
+RewriteCond %{REQUEST_FILENAME} -f [OR]
+RewriteCond %{REQUEST_FILENAME} -d
+RewriteRule ^ - [L]
+
+# 1) (optionnel) Normaliser la barre finale (sauf /)
+RewriteCond %{REQUEST_URI} !^/$
+RewriteCond %{REQUEST_URI} (.+)/$
+RewriteRule ^ %1 [R=301,L]
+
+# 2) URL "propres" sans extension -> router.php
+RewriteRule ^([^.]+)$ router.php?slug=$1 [L,QSA]
+
+# 3) Fallback général
+RewriteRule ^ index.php [L,QSA]
+
+# --- PWA / Types & cache SW ---
+AddType application/manifest+json .webmanifest
+
+<Files "sw.js">
+  Header set Cache-Control "no-cache, no-store, must-revalidate"
+  Header set Pragma "no-cache"
+  Header set Expires "0"
+</Files>
+
+# Activer des en-têtes différents uniquement pour /visio/join.php
+SetEnvIf Request_URI "^/visio/join\.php$" IS_VISIO=1
+
+<IfModule mod_headers.c>
+  Header always unset Permissions-Policy env=IS_VISIO
+  Header always unset Feature-Policy   env=IS_VISIO
+  Header always set Permissions-Policy "camera=(self 'https://meet.uslugi.fr'), microphone=(self 'https://meet.uslugi.fr'), display-capture=(self 'https://meet.uslugi.fr'), fullscreen=(self 'https://meet.uslugi.fr')" env=IS_VISIO
+  Header always set Feature-Policy "camera 'self' https://meet.uslugi.fr; microphone 'self' https://meet.uslugi.fr" env=IS_VISIO
+
+  Header always set Content-Security-Policy "default-src 'self'; frame-src https://meet.uslugi.fr; script-src 'self' 'unsafe-inline' https://meet.uslugi.fr; connect-src 'self' https://meet.uslugi.fr wss://meet.uslugi.fr; img-src 'self' data: https://meet.uslugi.fr; style-src 'self' 'unsafe-inline' https://meet.uslugi.fr" env=IS_VISIO
+</IfModule>
+
+DirectoryIndex  index.php index.html
+
+