86 lines
3.7 KiB
ApacheConf
86 lines
3.7 KiB
ApacheConf
# --- Sécurité : en-têtes globaux ---
|
||
<IfModule mod_headers.c>
|
||
Header always set X-Content-Type-Options "nosniff"
|
||
Header always set X-Frame-Options "DENY"
|
||
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
||
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
|
||
Header always set Cross-Origin-Opener-Policy "same-origin"
|
||
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||
# CSP en observation (ne bloque rien pour l’instant)
|
||
# --- CSP (global) : autorise Matomo + CDNs ---
|
||
Header always set Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https: https://staging.uslugi.fr/matomo/; script-src 'self' 'unsafe-inline' https://staging.uslugi.fr/matomo/ https://cdn.jsdelivr.net https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-ancestors 'none'"
|
||
|
||
</IfModule>
|
||
|
||
# Réduire surface d’attaque
|
||
Options -Indexes -MultiViews
|
||
|
||
# --- Réécriture & HTTPS ---
|
||
RewriteEngine On
|
||
|
||
# Forcer HTTPS (OK derrière proxy/Varnish)
|
||
RewriteCond %{HTTPS} !=on
|
||
RewriteCond %{HTTP:X-Forwarded-Proto} !https
|
||
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
||
|
||
# Laisser passer Let's Encrypt
|
||
RewriteRule ^\.well-known/acme-challenge/ - [L]
|
||
|
||
# --- Protection chemins & fichiers sensibles ---
|
||
# Bloquer VCS
|
||
RewriteRule ^(\.git|\.svn|\.hg)(/|$) - [F]
|
||
# Bloquer dotfiles (sauf .well-known)
|
||
RewriteRule ^\.(?!well-known/) - [F]
|
||
# Bloquer extensions sensibles
|
||
RewriteRule \.(env|ini|log|bak|old|sql|zip|tar|gz|7z)$ - [F]
|
||
# Bloquer fichiers sauvegardes *~
|
||
RewriteRule ^(.*/)?[^/]+~$ - [F]
|
||
# Bloquer certains noms explicites
|
||
<FilesMatch "^(config\.php|config\.sample\.php|composer\.json|composer\.lock|package\.json|yarn\.lock)$">
|
||
Require all denied
|
||
</FilesMatch>
|
||
# Ceinture+bretelles : jamais de scripts dans /uploads
|
||
RewriteRule ^(?:public/)?uploads/.*\.(php|phtml|phar|phps|cgi|pl|py|sh|rb)$ - [F,NC]
|
||
|
||
# --- Routage applicatif ---
|
||
# 0) Servir les fichiers/dirs existants
|
||
RewriteCond %{REQUEST_FILENAME} -f [OR]
|
||
RewriteCond %{REQUEST_FILENAME} -d
|
||
RewriteRule ^ - [L]
|
||
|
||
# 1) (optionnel) Normaliser la barre finale (sauf /)
|
||
RewriteCond %{REQUEST_URI} !^/$
|
||
RewriteCond %{REQUEST_URI} (.+)/$
|
||
RewriteRule ^ %1 [R=301,L]
|
||
|
||
# 2) URL "propres" sans extension -> router.php
|
||
RewriteRule ^([^.]+)$ router.php?slug=$1 [L,QSA]
|
||
|
||
# 3) Fallback général
|
||
RewriteRule ^ index.php [L,QSA]
|
||
|
||
# --- PWA / Types & cache SW ---
|
||
AddType application/manifest+json .webmanifest
|
||
|
||
<Files "sw.js">
|
||
Header set Cache-Control "no-cache, no-store, must-revalidate"
|
||
Header set Pragma "no-cache"
|
||
Header set Expires "0"
|
||
</Files>
|
||
|
||
# Activer des en-têtes différents uniquement pour /visio/join.php
|
||
SetEnvIf Request_URI "^/visio/join\.php$" IS_VISIO=1
|
||
|
||
<IfModule mod_headers.c>
|
||
Header always unset Permissions-Policy env=IS_VISIO
|
||
Header always unset Feature-Policy env=IS_VISIO
|
||
Header always set Permissions-Policy "camera=(self 'https://meet.uslugi.fr'), microphone=(self 'https://meet.uslugi.fr'), display-capture=(self 'https://meet.uslugi.fr'), fullscreen=(self 'https://meet.uslugi.fr')" env=IS_VISIO
|
||
Header always set Feature-Policy "camera 'self' https://meet.uslugi.fr; microphone 'self' https://meet.uslugi.fr" env=IS_VISIO
|
||
|
||
Header always set Content-Security-Policy "default-src 'self'; frame-src https://meet.uslugi.fr; script-src 'self' 'unsafe-inline' https://meet.uslugi.fr; connect-src 'self' https://meet.uslugi.fr wss://meet.uslugi.fr; img-src 'self' data: https://meet.uslugi.fr; style-src 'self' 'unsafe-inline' https://meet.uslugi.fr" env=IS_VISIO
|
||
</IfModule>
|
||
|
||
DirectoryIndex index.php index.html
|
||
|
||
|