ServerAdmin webmaster@localhost DocumentRoot /var/www/html Options -Indexes +FollowSymLinks # Cacti ships .htaccess deny rules in bin/, cli/, contrib/, log/, mibs/, # rra/, scripts/, tests/ and cache/ subdirectories (Require all denied / # Order,Deny) to block direct web access to logs and non-executed files. # FileInfo/Options alone does not cover the AuthConfig/Limit override # types those rules need, which silently disables them # (GHSA-fxfg-j995-j69j); AllowOverride All lets them apply. AllowOverride All Require all granted # The source tree is bind mounted, so .env, .git and other dotfiles # sit in the web root. Require all denied # Proxy PHP requests to php-fpm SetHandler "proxy:fcgi://127.0.0.1:9000" # docker-compose.yml mounts empty named volumes over cache/, rra/ and log/, # hiding the .htaccess files shipped there, so repeat the denies here where # no mount can mask them. DirectoryMatch is merged after .htaccess files. Require all denied Require all denied # Logging ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined # Security headers Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "SAMEORIGIN" # X-XSS-Protection is deprecated; kept for legacy browsers only. # Cacti sets its own CSP headers at the application layer. # TODO: remove once minimum-browser support allows dropping it. Header always set X-XSS-Protection "1; mode=block" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()" Header always set X-Permitted-Cross-Domain-Policies "none"