# server-info/.htaccess architecture

> Architecture diagram of the GitHub repository server-info/.htaccess, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-05-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/server-info/.htaccess
- Repository: https://github.com/server-info/.htaccess

## Overview

This repository is not an application or library; it is a single-purpose security guidance document centered on Apache HTTP Server exposure risks.

The entire repo consists of one top-level artifact, `README.md`. There are no source files, build scripts, tests, containers, or runtime components. For an architecture diagram, this should be represented as a documentation-only repo with no executable system boundary.

The content is organized around one security pattern: the public exposure of Apache’s `mod_info` and the associated leak of configuration details, especially `.htaccess`-derived directives. The README explicitly notes that `.htaccess` itself is not the problem; the risk comes from pairing it with an externally reachable server-info endpoint.

The main “subsystems” described are:
- Apache `mod_info`, which exposes parsed server configuration at `/server-info`
- Apache `mod_status`, referenced as a similar endpoint at `/server-status`
- `.htaccess` files, which can reveal internal paths, auth backends, and rewrite rules
- public internet exposure, which is the attacker-facing boundary

The data flow described is simple: Apache parses configuration and, if `mod_info` is enabled and reachable, renders that configuration to an HTTP response. That response can include virtual hosts, loaded modules, directive values, and filesystem paths, which becomes reconnaissance data for external bots or attackers.

The trust boundary is the server edge. The repo’s core message is that administrative/debug endpoints must not cross from internal-only access into public access. The recommended controls all reinforce that boundary by restricting access to loopback/internal networks and denying direct access to dotfiles.

Mitigations called out in the README are operational configuration controls, not code changes:
- restrict `/server-info` with IP-based access control
- similarly restrict `/server-status`
- deny serving `.ht*` files directly
- reduce fingerprinting via `ServerTokens Prod` and `ServerSignature Off`

The verification step is also part of the architecture. The README recommends testing from an external machine with `curl -I` against `/server-info` and `/server-status` to confirm that the public interface returns 403 or 404. That makes external reachability the key acceptance criterion.

Overall, the repo’s architecture is best described as a security education artifact with three logical layers: exposed Apache diagnostics, configuration-sensitive metadata, and defensive access controls. It teaches how a small misconfiguration can turn internal server metadata into an externally observable attack surface.

Main entry points: [`README.md`](https://github.com/server-info/.htaccess/blob/main/README.md) (README)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_docs["Documentation"]
  node_readme["README<br/>guidance doc<br/>[README.md]"]
end

subgraph group_attack["Exposure"]
  node_public(("Public Internet<br/>trust boundary"))
  node_mod_info["mod_info<br/>apache module"]
  node_server_info["/server-info<br/>diagnostic endpoint"]
  node_mod_status["mod_status<br/>apache module"]
  node_server_status["/server-status<br/>diagnostic endpoint"]
  node_htaccess[".htaccess<br/>config file"]
  node_apache_cfg[("Apache Config<br/>server config")]
  node_leak{{"Leakage<br/>metadata exposure"}}
end

subgraph group_controls["Mitigations"]
  node_ip_acl["IP ACLs<br/>access control"]
  node_deny_ht["Deny dotfiles<br/>file access policy"]
  node_fingerprint["Fingerprinting<br/>hardening"]
  node_verify(("External check<br/>validation step"))
end

node_readme -->|"describes"| node_mod_info
node_readme -->|"references"| node_mod_status
node_readme -->|"warns about"| node_htaccess
node_mod_info -->|"serves"| node_server_info
node_mod_status -->|"serves"| node_server_status
node_server_info -->|"reveals"| node_apache_cfg
node_htaccess -->|"contains"| node_apache_cfg
node_public -->|"probes"| node_server_info
node_public -->|"probes"| node_server_status
node_apache_cfg -->|"creates"| node_leak
node_server_info -->|"exposes"| node_leak
node_server_status -->|"exposes"| node_leak
node_ip_acl -->|"restricts"| node_server_info
node_ip_acl -->|"restricts"| node_server_status
node_deny_ht -->|"blocks"| node_htaccess
node_fingerprint -->|"reduces"| node_leak
node_verify -->|"checks"| node_server_info
node_verify -->|"checks"| node_server_status

click node_readme "https://github.com/server-info/.htaccess/blob/main/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_readme toneBlue
class node_public,node_mod_info,node_server_info,node_mod_status,node_server_status,node_htaccess,node_apache_cfg,node_leak toneAmber
class node_ip_acl,node_deny_ht,node_fingerprint,node_verify toneMint
```

## Components

### Documentation

Single-file guidance repository.

- [README](https://github.com/server-info/.htaccess/blob/main/README.md): guidance doc · Single security guidance document for Apache exposure risks. · `README.md`

### Exposure

Public-facing Apache diagnostics and leaked metadata.

- **Public Internet**: trust boundary · External attackers and bots that can probe exposed endpoints.
- **mod_info**: apache module · Exposes parsed configuration via /server-info when reachable.
- **/server-info**: diagnostic endpoint · Administrative endpoint that can leak Apache configuration details.
- **mod_status**: apache module · Status module referenced as a similar internal-only endpoint.
- **/server-status**: diagnostic endpoint · Administrative status endpoint that should not be publicly reachable.
- **.htaccess**: config file · Access and rewrite directives that may reveal internal paths and auth details.
- **Apache Config**: server config · Loaded modules, vhosts, directives, and filesystem paths parsed by Apache.
- **Leakage**: metadata exposure · Configuration and path data exposed to unauthenticated clients.

### Mitigations

Operational controls that keep diagnostics internal.

- **IP ACLs**: access control · Restrict diagnostic endpoints to loopback or internal networks.
- **Deny dotfiles**: file access policy · Block direct serving of .ht* files from the web server.
- **Fingerprinting**: hardening · Reduce banner and signature detail with ServerTokens Prod and ServerSignature Off.
- **External check**: validation step · Confirm public access is denied using curl from an outside machine.

## Connections

- README → mod_info: describes · The guide centers on mod_info exposure.
- README → mod_status: references · The guide also discusses mod_status as a similar endpoint.
- README → .htaccess: warns about · Explains how .htaccess can leak sensitive internal details.
- mod_info → /server-info: serves · Enabled mod_info can render configuration at /server-info.
- mod_status → /server-status: serves · Enabled status module can expose /server-status.
- /server-info → Apache Config: reveals · The endpoint can expose loaded modules, directives, and vhosts.
- .htaccess → Apache Config: contains · Dotfile directives may expose auth backends, rewrites, and paths.
- Public Internet → /server-info: probes · External clients can reach the endpoint if it is exposed.
- Public Internet → /server-status: probes · External clients can reach the status endpoint if it is exposed.
- Apache Config → Leakage: creates · Parsed configuration becomes reconnaissance data when exposed.
- /server-info → Leakage: exposes · Public server-info responses leak internal metadata.
- /server-status → Leakage: exposes · Public server-status responses can reveal operational details.
- IP ACLs → /server-info: restricts · Limit access to trusted internal addresses.
- IP ACLs → /server-status: restricts · Limit access to trusted internal addresses.
- Deny dotfiles → .htaccess: blocks · Prevent direct retrieval of dotfiles over HTTP.
- Fingerprinting → Leakage: reduces · Lower banner and signature detail to shrink exposed metadata.
- External check → /server-info: checks · Validate that external requests return 403 or 404.
- External check → /server-status: checks · Validate that external requests return 403 or 404.