76 lines
2.7 KiB
ApacheConf
76 lines
2.7 KiB
ApacheConf
# --------------------------------
|
|
# Base: safe in most environments
|
|
# --------------------------------
|
|
Options -Indexes
|
|
DirectoryIndex index.html
|
|
|
|
<IfModule mod_authz_core.c>
|
|
<FilesMatch "^\.">
|
|
Require all denied
|
|
</FilesMatch>
|
|
</IfModule>
|
|
|
|
RewriteEngine On
|
|
#RewriteCond %{HTTPS} off
|
|
#RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
|
|
|
|
# MIME types for fonts/SVG
|
|
<IfModule mod_mime.c>
|
|
AddType font/woff2 .woff2
|
|
AddType font/woff .woff
|
|
AddType image/svg+xml .svg
|
|
</IfModule>
|
|
|
|
# Security headers
|
|
<IfModule mod_headers.c>
|
|
Header always set X-Frame-Options "SAMEORIGIN"
|
|
Header always set X-XSS-Protection "1; mode=block"
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
|
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
|
|
Header always set X-Download-Options "noopen"
|
|
Header always set Expect-CT "max-age=86400, enforce"
|
|
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; worker-src 'self' blob:; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'"
|
|
</IfModule>
|
|
|
|
# Caching
|
|
SetEnvIfNoCase QUERY_STRING "(^|&)v=" has_version_param=1
|
|
<IfModule mod_headers.c>
|
|
<FilesMatch "\.(html?|php)$">
|
|
Header set Cache-Control "no-cache, no-store, must-revalidate"
|
|
Header set Pragma "no-cache"
|
|
Header set Expires "0"
|
|
</FilesMatch>
|
|
|
|
<FilesMatch "^js/version\.js$">
|
|
Header set Cache-Control "no-cache, no-store, must-revalidate"
|
|
Header set Pragma "no-cache"
|
|
Header set Expires "0"
|
|
</FilesMatch>
|
|
|
|
<FilesMatch "\.(js|css)$">
|
|
Header set Cache-Control "public, max-age=3600, must-revalidate" env=!has_version_param
|
|
</FilesMatch>
|
|
|
|
<FilesMatch "\.(png|jpe?g|gif|webp|svg|ico|woff2?|ttf|otf)$">
|
|
Header set Cache-Control "public, max-age=604800" env=!has_version_param
|
|
</FilesMatch>
|
|
|
|
<FilesMatch "\.(js|css|png|jpe?g|gif|webp|svg|ico|woff2?|ttf|otf)$">
|
|
Header set Cache-Control "public, max-age=31536000, immutable" env=has_version_param
|
|
</FilesMatch>
|
|
</IfModule>
|
|
|
|
# Compression (only if module exists)
|
|
<IfModule mod_brotli.c>
|
|
BrotliCompressionQuality 5
|
|
AddOutputFilterByType BROTLI_COMPRESS text/html text/css application/javascript application/json image/svg+xml
|
|
</IfModule>
|
|
<IfModule mod_deflate.c>
|
|
AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
|
|
</IfModule>
|
|
|
|
# Disable TRACE
|
|
RewriteCond %{REQUEST_METHOD} ^TRACE
|
|
RewriteRule .* - [F] |