Sync apache security.conf with default from 'apache2' pkg and reapply TKL mods

Author: JedMeister

overlays/apache/etc/apache2/conf-available/security.conf

@@ -1,16 +1,13 @@
-#
 # Disable access to the entire file system except for the directories that
 # are explicitly allowed later.
 #
-# This currently breaks the configurations that come with some web application
-# Debian packages.
+# This currently breaks some web app configurations
 #
 #<Directory />
 #   AllowOverride None
 #   Require all denied
 #</Directory>
 
-
 # Changing the following options will not really affect the security of the
 # server, but might make attacks slightly more difficult in some cases.
 
@@ -21,9 +18,6 @@
 # and compiled in modules.
 # Set to one of:  Full | OS | Minimal | Minor | Major | Prod
 # where Full conveys the most information, and Prod the least.
-#ServerTokens Minimal
-#ServerTokens OS
-#ServerTokens Full
 ServerTokens Prod
 
 #
@@ -34,7 +28,6 @@ ServerTokens Prod
 # Set to "EMail" to also include a mailto: link to the ServerAdmin.
 # Set to one of:  On | Off | EMail
 ServerSignature Off
-#ServerSignature On
 
 #
 # Allow TRACE method
@@ -44,34 +37,35 @@ ServerSignature Off
 #
 # Set to one of:  On | Off | extended
 TraceEnable Off
-#TraceEnable On
 
 #
 # Forbid access to version control directories
 #
 # If you use version control systems in your document root, you should
-# probably deny access to their directories. For example, for subversion:
+# probably deny access to their directories.
+#
+# Examples:
 #
-<DirectoryMatch "/\.svn">
-   Require all denied
-</DirectoryMatch>
-<DirectoryMatch "/\.git">
-   Require all denied
-</DirectoryMatch>
+#RedirectMatch 404 /\.git
+#RedirectMatch 404 /\.svn
+
+# Forbid acccess to any/all dot files/dirs
+RedirectMatch 404 "/\."
+# Note this will also deny access to .well-known so needs to be disabled if
+# using non-TurnKey Let's Encrypt tool - e.g. certbot
 
 #
 # Setting this header will prevent MSIE from interpreting files as something
 # else than declared by the content type in the HTTP headers.
 # Requires mod_headers to be enabled.
 #
-#Header set X-Content-Type-Options: "nosniff"
+Header set X-Content-Type-Options: "nosniff"
 
 #
 # Setting this header will prevent other sites from embedding pages from this
 # site as frames. This defends against clickjacking attacks.
 # Requires mod_headers to be enabled.
-#
-#Header set X-Frame-Options: "sameorigin"
 
+Header set Content-Security-Policy "frame-ancestors 'self';"
 
 # vim: syntax=apache ts=4 sw=4 sts=4 sr noet