# Protects EVERY file in this directory (index.php, and any partials it
# serves via ?partial=...) with Apache Basic Auth. Nothing in index.php
# itself checks who's logged in - Apache is the only gate, so this file is
# what makes the admin tool secure. This is what lets it work identically
# on systems with or without Supermon and/or AllStarLink installed.
#
# By default this uses a password file in this directory:
#   /var/www/html/tlb-admin/.htpasswd
# Create one with:
#   htpasswd -cB /var/www/html/tlb-admin/.htpasswd yourusername
# (drop -c and only use -B if the file already exists and you're adding another user)
#
# Prefer to reuse your existing Supermon login instead? Point AuthUserFile
# below at Supermon's .htpasswd (commonly /var/www/html/supermon/.htpasswd).
#
# Apache2: FilesMatch forbids direct URL download of sensitive files.
# Does NOT stop code running ON this machine from using those files.
# Pattern matches supermon/.htaccess (Paul Aidukas KN2R).
AuthType Basic
AuthName "LinkBox tlb-admin"
AuthUserFile /var/www/html/tlb-admin/.htpasswd
Require valid-user

# Forbid direct access to both .ht* (.htaccess & .htpasswd) files
<FilesMatch "^\.ht">
	Require all denied
</FilesMatch>

# Also forbid direct access/download of .inc .sh .bak .log etc.
# (same idea as /var/www/html/supermon/.htaccess — Apache 2.4 syntax)
<FilesMatch "\.(htaccess|htpasswd|ini|ini\.php|ini\.bak|sample|log|sh|inc|bak|save)$">
	Require all denied
</FilesMatch>