ServerRoot "/etc/apache2"

##noodl: This isn't used unless you specify a file based AcceptMutex (which isn't recommended)
LockFile /var/lock/apache2/accept.lock

PidFile /var/run/apache2.pid

Listen 80
## I intend to run at least one SSL vhost [as I, as of yet only have one IP ;]
Listen 443


#dealing with browsers and users...
# waiting for slow clients
# using Apache defaults
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100

##noodl: I tend to keep this lower, around 3-5
KeepAliveTimeout 15

BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0

#
# The following directive disables redirects on non-GET requests for
# a directory that does not include the trailing slash.  This fixes a 
# problem with Microsoft WebFolders which does not appropriately handle 
# redirects for folders with DAV methods.
#

BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^gnome-vfs" redirect-carefully 
BrowserMatch "^WebDAVFS/1.[012]" redirect-carefully


# putting limits on HTTP requests
# using Apache's defaults.
# as of yet...

##noodl: why specify a bunch of defaults? Also, I don't think LimitXMLRequestBody has any effect unless you're using DAV
LimitRequestBody 0
LimitRequestFields 100
LimitRequestFieldsize 8190
LimitRequestLine 8190
LimitXMLRequestBody 1000000

# < fajita> jMCg: prefork is what you need for various dodgy software including *PHP*
# using Apache Security's recommendation:
StartServers         5
MinSpareServers      5
MaxSpareServers     10
MaxClients          100
MaxRequestsPerChild  10000



# general Configuration stuff... 'tightened'...
## ServerAdmin is only used when ServerSignature is 'email'
ServerAdmin webmaster@brainsware.org
ServerSignature Off
ServerTokens Prod


# allow no access to /
## Options FollowSymlinks here will speed things up so set it if you're confident enough that people won't be creating symlinks to other sites.
## (creating a symlink from /var/www/accessible to /etc/passwd isn't a problem because the latter is covered by this Deny)
<Directory />
	Order Deny,Allow
	Deny from all
	Options None
	AllowOverride None
</Directory>

## Deny access to sensetive files which could've been misplaced on the
## server, or which we do not want to be publically known:
## .htaccess and .htpasswd
## various backupfiles of editors or FTP programs
## shell configuration and history files
<FilesMatch "(^\.ht|~$|\.bak$|\.BAK$|\..*.swp$|^\..*rc|^\..*hist.*)">
    Order allow,deny
    Deny from all
</FilesMatch>

## Deny access to .svn or CVS directories..
## websites could be updated via svn or svs, if someone has access to these
## directories, s/he automatically has access to the source.
## i should consider including other fance stuff like darcs, git or whatnot.
<DirectoryMatch "(\.svn|CVS|RCS)">
	Order allow,deny
	Deny from all
</DirectoryMatch>

# if someone really badly wants to enable indexes, don't even show those files
# extending Debian defaults
IndexIgnore .??* *~ *# HEADER* *bak *BAK RCS CVS *,t


# TODO add icons for the types.. and add types for the.. types. O_o
TypesConfig /etc/mime.types

##noodl: twice?
TypesConfig /etc/mime.types
DefaultType text/plain

HostnameLookups Off

IndexOptions FancyIndexing VersionSort
DirectoryIndex index.html index.php


## hardening against DoS
# or at least trying...

##noodl: twice?
HostnameLookups Off
## using mod_deflate to compress output:
### will this now work on all subsequently defined vhosts?
### it better does...
<Location />
	# Insert filter
	SetOutputFilter DEFLATE

	# Netscape 4.x has some problems...
	BrowserMatch ^Mozilla/4 gzip-only-text/html

	# Netscape 4.06-4.08 have some more problems
	BrowserMatch ^Mozilla/4\.0[678] no-gzip

	# MSIE masquerades as Netscape, but it is fine
	 BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

	# NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
	# the above regex won't work. You can use the following
	# workaround to get the desired effect:
	#BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
	# using 2.0.54 [at least ;]

	# Don't compress images
	SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary

	# Make sure proxies don't deliver the wrong content
	Header append Vary User-Agent env=!dont-vary
</Location>

## deny TRACE requests:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
## deny other, evil, websites to directly link our stuff!
## we don't get bandwidth for free!
# allow empty referrers, for users typing URLs directly:
RewriteCond %{HTTP_REFERER} !^$

# allow users coming from $domain.tld we serve:
RewriteCond %{HTTP_REFERER} !^http://.*\.?brainsware\.org [nocase]

# only prevent images from being hotlinked -- otherwise no one would be able to
# link to the site at all!

##noodl: use - rather than $0. better still, use FilesMatch like above. The first time you create a vhost, these will become ineffective.
RewriteRule (\.gif|\.jpe?g|\.png|\.swf)$ $0 [forbidden]



### Logging
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined


## we'll be using virtual hosts
UseCanonicalName Off