<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    <Directory /var/www/html/cacti>
        Options -Indexes +FollowSymLinks
        # Cacti ships .htaccess deny rules in log/, include/, scripts/, cache/,
        # and cli/ (Require all denied / Order,Deny) to block direct web access
        # to logs and non-executed files. FileInfo/Options alone does not cover
        # the AuthConfig/Limit override types those rules need, which silently
        # disables them (GHSA-fxfg-j995-j69j); AllowOverride All lets them apply.
        AllowOverride All
        Require all granted

        # Proxy PHP requests to php-fpm
        <FilesMatch \.php$>
            SetHandler "proxy:fcgi://127.0.0.1:9000"
        </FilesMatch>
    </Directory>

    # Logging
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    # Security headers
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    # X-XSS-Protection is deprecated; kept for legacy browsers only.
    # Cacti sets its own CSP headers at the application layer.
    # TODO: remove once minimum-browser support allows dropping it.
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
    Header always set X-Permitted-Cross-Domain-Policies "none"
</VirtualHost>