#19 Adjust htaccess for Drupal 8 and improve tag SetPermissions

tasks/install.yml

@@ -170,7 +170,9 @@
     - '{{ webRoot }}/config'
     - '{{ webRoot }}/files'
     - '{{ webRoot }}/settings'
-  tags: 'deploy'
+  tags:
+    - 'deploy'
+    - 'SetPermissions'
 
 - name: "Make site directories writeable"
   file:
@@ -180,7 +182,9 @@
   with_items:
     - '{{ webRoot }}/config'
     - '{{ webRoot }}/files'
-  tags: 'deploy'
+  tags:
+    - 'deploy'
+    - 'SetPermissions'
 
 - name: "Setup Crontabs for each domain"
   cron:
@@ -200,7 +204,22 @@
 
 - name: "Set Extended Permissions"
   command: setfacl -dRm u:{{ apacheUser }}:rwX,g:{{ apacheUser }}:rwX,o::rX {{ webRoot }}/files
-  tags: 'deploy'
+  tags:
+    - 'deploy'
+    - 'SetPermissions'
+
+- name: "Make htaccess read-only"
+  file:
+    path='{{ webRoot }}/files/{{ drupal_domain.0.shortname|default("default") }}/{{ drupal_domain.1 }}/.htaccess'
+    mode='444'
+  with_nested:
+    - '{{ drupal.domains }}'
+    - ['files', 'private']
+  loop_control:
+    loop_var: drupal_domain
+  tags:
+    - 'deploy'
+    - 'SetPermissions'
 
 - name: "Install Drupal Databases and Users"
   include_tasks: mysql.yml

templates/.htaccess

 # Turn off all options we don't need.
+{% if drupal.version|default('d8') == 'd8' %}
+Options -Indexes -ExecCGI -Includes -MultiViews
+{% else %}
 Options None
 Options +FollowSymLinks
+{% endif %}
 
 # Set the catch-all handler to prevent scripts from being executed.
 SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006