dadaloop82
d33b0ca2fe
Block web access to sensitive paths, require API_TOKEN for mutations, encrypt GitHub issue credentials in .env, auto-provision tokens for same-origin clients, and pass api_token in scale relay URLs since EventSource cannot send headers. Co-authored-by: Cursor <cursoragent@cursor.com>
33 lines
799 B
ApacheConf
33 lines
799 B
ApacheConf
RewriteEngine On
|
|
|
|
# Block sensitive files (Apache 2.4+)
|
|
<Files ".env">
|
|
Require all denied
|
|
</Files>
|
|
<Files ".env.example">
|
|
Require all denied
|
|
</Files>
|
|
<Files "backup.sh">
|
|
Require all denied
|
|
</Files>
|
|
<FilesMatch "^\.">
|
|
Require all denied
|
|
</FilesMatch>
|
|
|
|
# Force HTTPS
|
|
RewriteCond %{HTTPS} !=on
|
|
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
|
|
|
|
# API routing
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteRule ^api/(.*)$ api/index.php?action=$1&%{QUERY_STRING} [L,QSA]
|
|
AddType application/x-x509-ca-cert .crt
|
|
|
|
# Prevent caching of JS/CSS so kiosk always gets fresh files
|
|
<FilesMatch "\.(js|css)$">
|
|
Header set Cache-Control "no-cache, no-store, must-revalidate"
|
|
Header set Pragma "no-cache"
|
|
Header set Expires "0"
|
|
</FilesMatch>
|