diff --git a/etc/hosts b/etc/hosts index 63c10dd1..b79202d3 100644 --- a/etc/hosts +++ b/etc/hosts @@ -12,12 +12,9 @@ # Block procrastination websites ## -# Main time sinks 127.0.0.1 reddit.com 127.0.0.1 www.reddit.com 127.0.0.1 imgur.com 127.0.0.1 www.imgur.com 127.0.0.1 twitter.com 127.0.0.1 www.twitter.com -# 127.0.0.1 youtube.com -# 127.0.0.1 www.youtube.com diff --git a/etc/httpd/extra/httpd-autoindex.conf b/etc/httpd/extra/httpd-autoindex.conf index 972867dc..8ec60f8c 100644 --- a/etc/httpd/extra/httpd-autoindex.conf +++ b/etc/httpd/extra/httpd-autoindex.conf @@ -18,9 +18,9 @@ IndexOptions FancyIndexing HTMLTable VersionSort # We include the /icons/ alias for FancyIndexed directory listings. If # you do not use FancyIndexing, you may comment this out. # -Alias /icons/ "/usr/local/opt/httpd/share/httpd/icons/" +Alias /icons/ "/opt/homebrew/opt/httpd/share/httpd/icons/" - + Options Indexes MultiViews AllowOverride None Require all granted diff --git a/etc/httpd/extra/httpd-dav.conf b/etc/httpd/extra/httpd-dav.conf index a4caae89..356bf196 100644 --- a/etc/httpd/extra/httpd-dav.conf +++ b/etc/httpd/extra/httpd-dav.conf @@ -12,18 +12,18 @@ # on the directory where the DavLockDB is placed and on any directory where # "Dav On" is specified. -DavLockDB "/usr/local/opt/httpd/var/DavLock" +DavLockDB "/opt/homebrew/opt/httpd/var/DavLock" -Alias /uploads "/usr/local/opt/httpd/uploads" +Alias /uploads "/opt/homebrew/opt/httpd/uploads" - + Dav On AuthType Digest AuthName DAV-upload # You can use the htdigest program to create the password database: - # htdigest -c "/usr/local/opt/httpd/user.passwd" DAV-upload admin - AuthUserFile "/usr/local/opt/httpd/user.passwd" + # htdigest -c "/opt/homebrew/opt/httpd/user.passwd" DAV-upload admin + AuthUserFile "/opt/homebrew/opt/httpd/user.passwd" AuthDigestProvider file # Allow universal read-access, but writes are restricted diff --git a/etc/httpd/extra/httpd-default.conf b/etc/httpd/extra/httpd-default.conf index e01a9ff1..f1e7bc82 100644 --- a/etc/httpd/extra/httpd-default.conf +++ b/etc/httpd/extra/httpd-default.conf @@ -7,7 +7,7 @@ # # Timeout: The number of seconds before receives and sends time out. # -Timeout 3600 +Timeout 300 # # KeepAlive: Whether or not to allow persistent connections (more than diff --git a/etc/httpd/extra/httpd-h5bp-server-configs.conf b/etc/httpd/extra/httpd-h5bp-server-configs.conf index a0b88af6..572f6de2 100644 --- a/etc/httpd/extra/httpd-h5bp-server-configs.conf +++ b/etc/httpd/extra/httpd-h5bp-server-configs.conf @@ -1,4 +1,4 @@ -# Apache Server Configs v4.1.0 | MIT License +# Apache Server Configs v5.0.0 | MIT License # https://github.com/h5bp/server-configs-apache # (!) Using `.htaccess` files slows down Apache, therefore, if you have @@ -27,9 +27,15 @@ # allowing access based on (sub)domain: # # Header set Access-Control-Allow-Origin "subdomain.example.com" +# +# (1) When `Access-Control-Allow-Origin` points to a specific rule rather +# than `*`, then `Vary: Origin` should be sent along with the response. # # Header set Access-Control-Allow-Origin "*" + +# # (1) +# # Header append Vary Origin # # ---------------------------------------------------------------------- @@ -43,7 +49,7 @@ - + SetEnvIf Origin ":" IS_CORS Header set Access-Control-Allow-Origin "*" env=IS_CORS @@ -109,32 +115,6 @@ Options -MultiViews -# ###################################################################### -# # INTERNET EXPLORER # -# ###################################################################### - -# ---------------------------------------------------------------------- -# | Document modes | -# ---------------------------------------------------------------------- - -# Force Internet Explorer 8/9/10 to render pages in the highest mode -# available in various cases when it may not. -# -# https://hsivonen.fi/doctype/#ie8 -# -# (!) Starting with Internet Explorer 11, document modes are deprecated. -# If your business still relies on older web apps and services that were -# designed for older versions of Internet Explorer, you might want to -# consider enabling `Enterprise Mode` throughout your company. -# -# https://msdn.microsoft.com/en-us/library/ie/bg182625.aspx#docmode -# https://blogs.msdn.microsoft.com/ie/2014/04/02/stay-up-to-date-with-enterprise-mode-for-internet-explorer-11/ -# https://msdn.microsoft.com/en-us/library/ff955275.aspx - - - Header always set X-UA-Compatible "IE=edge" "expr=%{CONTENT_TYPE} =~ m#text/html#i" - - # ###################################################################### # # MEDIA TYPES AND CHARACTER ENCODINGS # # ###################################################################### @@ -183,6 +163,7 @@ Options -MultiViews AddType image/avif avif AddType image/avif-sequence avifs AddType image/bmp bmp + AddType image/jxl jxl AddType image/svg+xml svg svgz AddType image/webp webp AddType video/mp4 f4v f4p m4v mp4 @@ -453,8 +434,7 @@ AddDefaultCharset utf-8 # # Keep in mind that while you could send the `X-Frame-Options` header for all # of your website's pages, this has the potential downside that it forbids even -# non-malicious framing of your content (e.g.: when users visit your website -# using a Google Image Search results page). +# non-malicious framing of your content. # # Nonetheless, you should ensure that you send the `X-Frame-Options` header for # all pages that allow a user to make a state-changing operation (e.g: pages @@ -465,10 +445,13 @@ AddDefaultCharset utf-8 # more than just clickjacking attacks. # https://cure53.de/xfo-clickjacking.pdf. # -# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options +# (!) The `Content-Security-Policy` header has a `frame-ancestors` directive +# which obsoletes this header for supporting browsers. +# # https://tools.ietf.org/html/rfc7034 -# https://blogs.msdn.microsoft.com/ieinternals/2010/03/30/combating-clickjacking-with-x-frame-options/ -# https://www.owasp.org/index.php/Clickjacking +# https://owasp.org/www-project-secure-headers/#x-frame-options +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options +# https://docs.microsoft.com/archive/blogs/ieinternals/combating-clickjacking-with-x-frame-options # # Header always set X-Frame-Options "DENY" "expr=%{CONTENT_TYPE} =~ m#text/html#i" @@ -517,10 +500,17 @@ AddDefaultCharset utf-8 # The `frame-ancestors` directive helps avoid "Clickjacking" attacks and # is similar to the `X-Frame-Options` header. # -# Browsers that support the CSP header will ignore `X-Frame-Options` if +# Browsers that support the CSP header should ignore `X-Frame-Options` if # `frame-ancestors` is also specified. # -# (5) Forces the browser to treat all the resources that are served over HTTP +# (5) Elements controlled by `object-src` are perhaps coincidentally +# considered legacy HTML elements and are not receiving new standardized +# features (such as the security attributes `sandbox` or `allow` for +# `