Suggestion: drop Options Indexes from the generated vhost

[radialmonster]

Thanks for maintaining this script — it makes standing up a Blesta host on a fresh VPS very straightforward.

One suggestion about the vhost it generates, which includes Indexes in the Options line:

<Directory /home/blesta/public_html>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Require all granted
</Directory>

Blesta doesn't appear to need directory listings — requests route through index.php and static assets are fetched by direct path — so this mainly has downsides.

Why we'd suggest turning it off:

1. It advertises the installation's makeup. /components/modules/, /components/gateways/ and /plugins/ list exactly which modules, gateways and plugins a site runs, and /config/ lists its config filenames. For someone looking for a known issue in a specific module or gateway, that's a free targeting list, and automated scanners walk these paths as a matter of course.

2. It makes any non-executing file in the docroot easy to find. Anything Apache won't hand to PHP is served as plain text — a .bak or .orig from an edit or a patch, a .swp from an interrupted editor session, a file left mid-upload during an upgrade. Those things do land in config directories during maintenance, by admins and by tooling. Without listings an outsider would have to guess the exact filename; with listings it's simply linked. Since config/blesta.php holds the database credentials and the system key, a stray non-.php copy sitting alongside it is a bad thing to have discoverable, and Indexes is the difference between "someone would have to know the filename" and "it's right there in the index."

Neither is a flaw in Blesta itself — the app is fine, and .php files execute normally. It's that the default leaves less margin for ordinary operational mistakes than it needs to, on installs whose operators are the least likely to review the vhost.

Verified safe to remove. On a live install with Indexes off, nothing broke — admin and client portals, the /app/ CSS and JS (bootstrap, jQuery, Font Awesome, the admin theme), /vendors/ assets (CKEditor, d3, nvd3), gateway stylesheets and module logos all load normally:

     <Directory /home/blesta/public_html>
-        Options Indexes FollowSymLinks MultiViews
+        Options FollowSymLinks MultiViews
         AllowOverride All
         Require all granted
     </Directory>

Tested on AlmaLinux with Apache 2.4.63 and PHP 8.2 from Remi, installed via install-blesta.sh from main.