apache/files/security.conf

{%- from "apache/map.jinja" import server with context -%}
ServerSignature {% if server.get('signature', False) %}On{% else %}Off{% endif %}
TraceEnable {% if server.get('trace', False) %}On{% else %}Off{% endif %}
ServerTokens {{ server.get('tokens', 'Prod') }}

{%- if server.get('secure_scm', True) %}
<DirectoryMatch "/\.svn">
    Require all denied
</DirectoryMatch>

<DirectoryMatch "/\.git">
    Require all denied
</DirectoryMatch>

<DirectoryMatch "/\.hg">
    Require all denied
</DirectoryMatch>
{%- endif %}

{%- if 'headers' in server.get('modules', []) %}
{%- if server.get('content_type_options', "nosniff") %}
Header set X-Content-Type-Options: "{{ server.get('content_type_options', 'nosniff') }}"
{%- endif %}

{%- if server.get('frame_options', "sameorigin") %}
Header set X-Frame-Options: "{{ server.get('frame_options', 'sameorigin') }}"
{%- endif %}
{%- endif %}