ServerRoot "/etc/apache2"
##noodl: This isn't used unless you specify a file based AcceptMutex (which isn't recommended)
LockFile /var/lock/apache2/accept.lock
PidFile /var/run/apache2.pid
Listen 80
## I intend to run at least one SSL vhost [as I, as of yet only have one IP ;]
Listen 443
#dealing with browsers and users...
# waiting for slow clients
# using Apache defaults
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
##noodl: I tend to keep this lower, around 3-5
KeepAliveTimeout 15
BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0
#
# The following directive disables redirects on non-GET requests for
# a directory that does not include the trailing slash. This fixes a
# problem with Microsoft WebFolders which does not appropriately handle
# redirects for folders with DAV methods.
#
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^gnome-vfs" redirect-carefully
BrowserMatch "^WebDAVFS/1.[012]" redirect-carefully
# putting limits on HTTP requests
# using Apache's defaults.
# as of yet...
##noodl: why specify a bunch of defaults? Also, I don't think LimitXMLRequestBody has any effect unless you're using DAV
LimitRequestBody 0
LimitRequestFields 100
LimitRequestFieldsize 8190
LimitRequestLine 8190
LimitXMLRequestBody 1000000
# < fajita> jMCg: prefork is what you need for various dodgy software including *PHP*
# using Apache Security's recommendation:
StartServers 5
MinSpareServers 5
MaxSpareServers 10
MaxClients 100
MaxRequestsPerChild 10000
# general Configuration stuff... 'tightened'...
## ServerAdmin is only used when ServerSignature is 'email'
ServerAdmin webmaster@brainsware.org
ServerSignature Off
ServerTokens Prod
# allow no access to /
## Options FollowSymlinks here will speed things up so set it if you're confident enough that people won't be creating symlinks to other sites.
## (creating a symlink from /var/www/accessible to /etc/passwd isn't a problem because the latter is covered by this Deny)
<Directory />
Order Deny,Allow
Deny from all
Options None
AllowOverride None
</Directory>
## Deny access to sensetive files which could've been misplaced on the
## server, or which we do not want to be publically known:
## .htaccess and .htpasswd
## various backupfiles of editors or FTP programs
## shell configuration and history files
<FilesMatch "(^\.ht|~$|\.bak$|\.BAK$|\..*.swp$|^\..*rc|^\..*hist.*)">
Order allow,deny
Deny from all
</FilesMatch>
## Deny access to .svn or CVS directories..
## websites could be updated via svn or svs, if someone has access to these
## directories, s/he automatically has access to the source.
## i should consider including other fance stuff like darcs, git or whatnot.
<DirectoryMatch "(\.svn|CVS|RCS)">
Order allow,deny
Deny from all
</DirectoryMatch>
# if someone really badly wants to enable indexes, don't even show those files
# extending Debian defaults
IndexIgnore .??* *~ *# HEADER* *bak *BAK RCS CVS *,t
# TODO add icons for the types.. and add types for the.. types. O_o
TypesConfig /etc/mime.types
##noodl: twice?
TypesConfig /etc/mime.types
DefaultType text/plain
HostnameLookups Off
IndexOptions FancyIndexing VersionSort
DirectoryIndex index.html index.php
## hardening against DoS
# or at least trying...
##noodl: twice?
HostnameLookups Off
## using mod_deflate to compress output:
### will this now work on all subsequently defined vhosts?
### it better does...
<Location />
# Insert filter
SetOutputFilter DEFLATE
# Netscape 4.x has some problems...
BrowserMatch ^Mozilla/4 gzip-only-text/html
# Netscape 4.06-4.08 have some more problems
BrowserMatch ^Mozilla/4\.0[678] no-gzip
# MSIE masquerades as Netscape, but it is fine
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
# NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
# the above regex won't work. You can use the following
# workaround to get the desired effect:
#BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
# using 2.0.54 [at least ;]
# Don't compress images
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
# Make sure proxies don't deliver the wrong content
Header append Vary User-Agent env=!dont-vary
</Location>
## deny TRACE requests:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
## deny other, evil, websites to directly link our stuff!
## we don't get bandwidth for free!
# allow empty referrers, for users typing URLs directly:
RewriteCond %{HTTP_REFERER} !^$
# allow users coming from $domain.tld we serve:
RewriteCond %{HTTP_REFERER} !^http://.*\.?brainsware\.org [nocase]
# only prevent images from being hotlinked -- otherwise no one would be able to
# link to the site at all!
##noodl: use - rather than $0. better still, use FilesMatch like above. The first time you create a vhost, these will become ineffective.
RewriteRule (\.gif|\.jpe?g|\.png|\.swf)$ $0 [forbidden]
### Logging
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
## we'll be using virtual hosts
UseCanonicalName Off