# BastionGuard WebUI - Apache 2.4 + PHP-FPM
# Install location: /usr/share/BastionGuard/webui
# Debian/Ubuntu: copy to /etc/apache2/conf-available/bastionguard-webui.conf and enable with a2enconf.
# Adjust the PHP-FPM socket if your PHP version uses a versioned socket, e.g. /run/php/php8.3-fpm.sock.

Alias /bastionguard /usr/share/BastionGuard/webui
Alias /bastionguard/ /usr/share/BastionGuard/webui/

<Directory "/usr/share/BastionGuard/webui">
    Options FollowSymLinks
    AllowOverride None
    DirectoryIndex index.php
    Require all granted
</Directory>

<DirectoryMatch "^/usr/share/BastionGuard/webui/(data|db|scripts)(/|$)">
    Require all denied
</DirectoryMatch>

<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php/php-fpm.sock|fcgi://localhost/"
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"
</IfModule>