# BastionGuard WebUI - Arch/Fedora/RHEL httpd + PHP-FPM
# Install location: /usr/share/BastionGuard/webui
# Arch socket is commonly /run/php-fpm/php-fpm.sock.
# Fedora/RHEL may use /run/php-fpm/www.sock. Adjust SetHandler if needed.

Alias /bastionguard /usr/share/BastionGuard/webui
Alias /bastionguard/ /usr/share/BastionGuard/webui/

<Directory "/usr/share/BastionGuard/webui">
    Options FollowSymLinks
    AllowOverride None
    DirectoryIndex index.php
    Require all granted
</Directory>

<DirectoryMatch "^/usr/share/BastionGuard/webui/(data|db|scripts)(/|$)">
    Require all denied
</DirectoryMatch>

<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php-fpm/php-fpm.sock|fcgi://localhost/"
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"
</IfModule>