# ============================================
# USER MANAGER v4.0 - LAYER 1: MODSECURITY
# Servizio: {SERVICE_DISPLAY_NAME}
# Template GENERICO
# ============================================
# IMPORTANTE: Questo blocco va DENTRO <VirtualHost>
# Adatta secondo le esigenze del servizio
# ============================================

<IfModule security2_module>
    SecRuleEngine On
    
    # Include whitelist globale
    Include /etc/modsecurity/usermanager-global-whitelist.conf
    
    # Include whitelist servizio
    Include /etc/modsecurity/usermanager-whitelist-{SERVICE_NAME}.conf
    
    # Escludi file User Manager
    SecRule REQUEST_URI "^/(set-cookies\.php|403\.(html|php))" "id:9000001,phase:1,pass,nolog,ctl:ruleEngine=Off"
    
    # Include deny-all
    Include /etc/modsecurity/usermanager-deny-all.conf
    
    <LocationMatch "^/403\.(html|php)$">
        SecRuleEngine Off
    </LocationMatch>
    
    <LocationMatch "^/set-cookies\.php$">
        SecRuleEngine Off
    </LocationMatch>
</IfModule>

# ErrorDocument
ErrorDocument 403 /403.php

# ============================================
# LAYER 2: HTPASSWD (opzionale - decommentare se necessario)
# ============================================
# <Location />
#     AuthType Basic
#     AuthName "{SERVICE_DISPLAY_NAME} - Layer 2"
#     AuthUserFile /etc/apache2/.htpasswd_{SERVICE_NAME}
#     Require valid-user
# </Location>
#
# # Esclusioni htpasswd per file User Manager
# <LocationMatch "^/(set-cookies\.php|403\.php)$">
#     Satisfy Any
#     Require all granted
# </LocationMatch>
