apache.conf

# The site inside the container. nginx on the host terminates TLS and proxies
# here over loopback, so this only speaks plain HTTP on port 80.

ServerTokens Prod
ServerSignature Off

# Few Apache processes: each holds its own PHP memory, and the forum gets
# little traffic. These override the image's mpm_prefork.conf. The numbers
# come from the environment, with defaults in the Containerfile.
<IfModule mpm_prefork_module>
	StartServers ${APACHE_START_SERVERS}
	MinSpareServers ${APACHE_MIN_SPARE_SERVERS}
	MaxSpareServers ${APACHE_MAX_SPARE_SERVERS}
	MaxRequestWorkers ${APACHE_MAX_REQUEST_WORKERS}
	# Replace each process after a while, so one that grew is not kept.
	MaxConnectionsPerChild ${APACHE_MAX_CONNECTIONS_PER_CHILD}
</IfModule>

<VirtualHost *:80>
	DocumentRoot /var/www/html

	# The client's address, as nginx found it behind Cloudflare. Only nginx
	# can reach this port, so the header is trusted from any local address.
	RemoteIPHeader X-Real-IP
	RemoteIPInternalProxy 127.0.0.0/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10

	# phpBB's own .htaccess files deny its internal folders (cache, files,
	# includes, store, vendor, ...) and route URLs through app.php. They are
	# part of each release, so they stay right as phpBB changes.
	<Directory /var/www/html>
		Options FollowSymLinks
		AllowOverride All
		Require all granted
	</Directory>

	# Uploads and caches are never fetched directly and never run: phpBB
	# serves attachments and avatars through download/file.php, which checks
	# permissions. These folders are mounts, which hide the .htaccess files the
	# release puts in them, so they are denied here instead.
	<Directory /var/www/html/files>
		php_admin_flag engine off
		Require all denied
	</Directory>
	<Directory /var/www/html/store>
		php_admin_flag engine off
		Require all denied
	</Directory>
	<Directory /var/www/html/images/avatars/upload>
		php_admin_flag engine off
		Require all denied
	</Directory>
	<Directory /var/www/html/cache>
		php_admin_flag engine off
		Require all denied
	</Directory>

	# config.php holds no secrets here, but is still nobody's business.
	<Files config.php>
		Require all denied
	</Files>
</VirtualHost>