detoxd/httpd repository overview

ServerSignature Off
ServerTokens Prod

# Disable directory browsing
<Directory />
    Options -Indexes -FollowSymLinks
    AllowOverride None
    Require all denied
</Directory>

# Secure document root
<Directory /var/www/html>
    Options -Indexes -ExecCGI
    AllowOverride None
    Require all granted
</Directory>

# Disable unnecessary modules
# LoadModule autoindex_module modules/mod_autoindex.so
# LoadModule status_module modules/mod_status.so
# LoadModule info_module modules/mod_info.so

# Security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Content-Security-Policy "default-src 'self'"

# Disable TRACE method
TraceEnable off

# Limit request size
LimitRequestBody 10485760
LimitRequestFields 50
LimitRequestFieldSize 8190
LimitRequestLine 8190

# Timeout settings
Timeout 60
KeepAliveTimeout 5

# Disable server-side includes
<Directory />
    Options -Includes
</Directory>

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/server.crt
    SSLCertificateKeyFile /etc/ssl/private/server.key
    
    # Strong SSL configuration
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on
    
    # HSTS
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</VirtualHost>

# Block SQL injection attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>).* [NC]
    RewriteRule ^(.*)$ - [F,L]
</IfModule>

# Disable access to sensitive files
<FilesMatch "^\.ht">
    Require all denied
</FilesMatch>

<FilesMatch "\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)$">
    Require all denied
</FilesMatch>

FROM detoxd/httpd:2.4-alpine-detox.1

# Copy custom configuration
COPY httpd.conf /usr/local/apache2/conf/httpd.conf
COPY httpd-ssl.conf /usr/local/apache2/conf/extra/httpd-ssl.conf

# Copy static content
COPY --chown=www-data:www-data html/ /usr/local/apache2/htdocs/

# Ensure correct permissions
RUN chmod -R 755 /usr/local/apache2/htdocs/

EXPOSE 80 443