I'm running an experimental just-for-fun Apache web server. Part of the idea behind this server is that it should be unusually open to the public; for example, the root filesystem should be open for anyone to browse. (Indeed, here it is: http://sylvester.s.zbasu.net/rootfs/) As a consequence, security is going to take a back seat.
That said, there are things which Apache should be able to access, but the public should not. The example which I'm running into is a Django site. The file
settings.py must be readable by Apache, or else Django won't work. But
settings.py must not be readable by the public, since it contains a secret key. So the file should be owned by
www-data, but Apache should nevertheless refuse to serve it.
One possible solution (thanks to
ellipsis753 on Freenode) is to create a special directive, perhaps in an
.htaccess file, telling Apache not to serve this file. However, I figure that if a file isn't readable by all users, it probably shouldn't be served by Apache, either.
Can I tell Apache that if a file isn't world-readable, then it shouldn't be served?