security.conf.example

# simple-httpd — security
# Small attack surface for a public HTTPS static site.
# TLS is required. Directory listing and symlinks are off. Timeouts and
# request sizes are tight. HSTS, CSP, rate limits, and method filtering are on.
#
# Point ssl_cert / ssl_key at real PEMs before starting.
# Optional: copy config/examples/htpasswd.example and set auth_basic_file.

[server]
listen_address = 0.0.0.0
listen_port = 443
document_root = /var/www/html
index_files = index.html
directory_listing = false
follow_symlinks = false
cache_max_age = 0
server_name = simple-httpd

[performance]
worker_threads = 8
http2 = true
max_connections = 256
request_timeout_seconds = 15
keep_alive = true
keep_alive_timeout_seconds = 5
max_request_size = 8192
max_header_count = 32
compression = true
compression_min_length = 1024

[ssl]
ssl_cert = /etc/simple-httpd/tls/fullchain.pem
ssl_key = /etc/simple-httpd/tls/privkey.pem
tls_min_version = 1.2
hsts = true
hsts_max_age = 31536000

[security]
security_headers = true
x_frame_options = DENY
referrer_policy = strict-origin-when-cross-origin
# style-src allows the built-in directory listing CSS if you turn listing on.
csp = default-src 'self'; style-src 'self' 'unsafe-inline'
allow_methods = GET, HEAD, OPTIONS
rate_limit_enabled = true
rate_limit_requests = 60
rate_limit_window_seconds = 60
max_connections_per_ip = 32
connection_rate_limit_enabled = true
connection_rate_limit = 30
connection_rate_window_seconds = 60
# allow_ips = 10.0.0.0/8,192.168.0.0/16
# deny_ips =
# auth_basic_realm = Restricted
# auth_basic_file = /etc/simple-httpd/htpasswd
# admin_path = /admin

[ops]
health_path = /healthz
metrics_path = /metrics
status_path = /status
# user = httpd
# group = httpd
# pid_file = /run/simple-httpd.pid

[logging]
log_level = warn
access_log = /var/log/simple-httpd/access.log
error_log = /var/log/simple-httpd/error.log
security_log = /var/log/simple-httpd/security.log