# Panduan Lengkap DIR//LISTER v26.0911

**Aplikasi:** DIR//LISTER (directory lister hardened)  
**Versi app:** v26.0911  
**Target server:** Ubuntu Server 26.04 LTS  
**Stack:** Apache **2.4.x** (≥ 2.4.68) · PHP **8.5.x** (≥ 8.5.9) · OpenSSL  
**Situs contoh:** abdurrozak.my.id  

Dokumen ini mencakup instalasi server dari nol, hardening, deploy aplikasi, konfigurasi fitur (lock, WebAuthn, analitik, SSE/WS), hingga tuning production.

---

## Daftar isi

1. [Prasyarat & arsitektur](#1-prasyarat--arsitektur)
2. [Persiapan Ubuntu Server 26.04](#2-persiapan-ubuntu-server-2604)
3. [Instalasi Apache 2.4](#3-instalasi-apache-24)
4. [Instalasi PHP 8.5 + ekstensi](#4-instalasi-php-85--ekstensi)
5. [PHP-FPM vs mod_php](#5-php-fpm-vs-mod_php)
6. [Konfigurasi PHP production](#6-konfigurasi-php-production)
7. [Virtual host & document root](#7-virtual-host--document-root)
8. [SSL/TLS (Let's Encrypt)](#8-ssltls-lets-encrypt)
9. [Security headers Apache](#9-security-headers-apache)
10. [Firewall & fail2ban](#10-firewall--fail2ban)
11. [Deploy file aplikasi](#11-deploy-file-aplikasi)
12. [File `.env` lengkap](#12-file-env-lengkap)
13. [Permission & kepemilikan](#13-permission--kepemilikan)
14. [Fitur: folder lock & static guard](#14-fitur-folder-lock--static-guard)
15. [Fitur: WebAuthn / passkey](#15-fitur-webauthn--passkey)
16. [Fitur: TOTP 2FA](#16-fitur-totp-2fa)
17. [Fitur: views, presence, device analytics](#17-fitur-views-presence-device-analytics)
18. [Realtime: SSE & WebSocket opsional](#18-realtime-sse--websocket-opsional)
19. [CDN (Cloudflare / Akamai)](#19-cdn-cloudflare--akamai)
20. [Tuning Apache](#20-tuning-apache)
21. [Tuning PHP-FPM](#21-tuning-php-fpm)
22. [Tuning sistem (sysctl, disk, log)](#22-tuning-sistem-sysctl-disk-log)
23. [Backup & rotasi log](#23-backup--rotasi-log)
24. [Checklist uji pasca-deploy](#24-checklist-uji-pasca-deploy)
25. [Troubleshooting](#25-troubleshooting)
26. [Keamanan operasional](#26-keamanan-operasional)

---

## 1. Prasyarat & arsitektur

### 1.1 Yang disediakan aplikasi

| Komponen | File |
|----------|------|
| Backend | `index.php` |
| Frontend | `index.js`, `index.css` |
| WebAuthn | `dl_webauthn.php` |
| Config | `.env` (dari `env` / `env.example`) |
| Apache rules | `.htaccess` (dari `htaccess`) |

### 1.2 Arsitektur singkat

```
Internet → (CDN opsional) → Apache 2.4 (TLS)
                              ├─ file statis (css/js) + cache headers
                              ├─ index.php (API + UI)
                              └─ folder terkunci → .htaccess Deny + unduh via ?api=download
```

### 1.3 Prasyarat server

- VPS/dedicated dengan IP publik
- Domain mengarah ke IP (A/AAAA record)
- Akses root atau sudo
- Minimal: 1 vCPU, 1 GB RAM (disarankan 2 GB+)
- Disk SSD

---

## 2. Persiapan Ubuntu Server 26.04

### 2.1 Update sistem

```bash
sudo apt update && sudo apt full-upgrade -y
sudo apt autoremove -y
sudo reboot
```

### 2.2 Paket dasar

```bash
sudo apt install -y \
  ca-certificates curl wget gnupg lsb-release \
  ufw fail2ban unzip git htop \
  software-properties-common apt-transport-https
```

### 2.3 User deploy (opsional, disarankan)

```bash
sudo adduser deploy
sudo usermod -aG sudo deploy
# login sebagai deploy untuk operasi sehari-hari
```

### 2.4 Sinkron waktu

```bash
sudo timedatectl set-timezone Asia/Jakarta
sudo timedatectl set-ntp true
timedatectl status
```

---

## 3. Instalasi Apache 2.4

```bash
sudo apt install -y apache2
sudo systemctl enable --now apache2
apache2 -v
```

### 3.1 Modul wajib

```bash
sudo a2enmod rewrite headers expires deflate ssl socache_shmcb
# Jika PHP-FPM:
sudo a2enmod proxy_fcgi setenvif
sudo systemctl restart apache2
```

### 3.2 AllowOverride untuk `.htaccess`

Tanpa ini, guard folder terkunci dan rewrite app **tidak jalan**.

Edit (sesuaikan path):

```bash
sudo nano /etc/apache2/apache2.conf
```

Pastikan untuk directory web:

```apache
<Directory /var/www/>
    Options -Indexes +FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>
```

```bash
sudo systemctl reload apache2
```

---

## 4. Instalasi PHP 8.5 + ekstensi

Nama paket dapat sedikit berbeda tergantung mirror Ubuntu 26.04. Pola umum:

```bash
# Jika PHP 8.5 ada di repo default:
sudo apt install -y \
  php8.5 php8.5-cli php8.5-fpm php8.5-common \
  php8.5-curl php8.5-mbstring php8.5-xml php8.5-zip \
  php8.5-gd php8.5-intl php8.5-bcmath \
  php8.5-opcache libapache2-mod-php8.5

php -v
# Harus menampilkan PHP 8.5.x
```

Jika paket `php8.5` belum muncul di repo, gunakan sumber resmi Ondřej Surý / dokumentasi Ubuntu 26.04 untuk PHP 8.5, lalu ulangi instalasi ekstensi di atas.

### 4.1 Ekstensi vs fitur app

| Ekstensi | Kegunaan |
|----------|----------|
| `openssl` (biasanya di core/cli) | WebAuthn, HTTPS crypto |
| `mbstring` | String aman / fallback |
| `json` | API JSON |
| `curl` | Webhook alert (opsional) |
| `zip` | Fitur arsip ZIP |
| `gd` / `fileinfo` | MIME / gambar |
| `opcache` | Performa |

Cek:

```bash
php -m | grep -Ei 'openssl|mbstring|json|curl|zip|gd|fileinfo|opcache'
```

---

## 5. PHP-FPM vs mod_php

| Mode | Kapan |
|------|--------|
| **PHP-FPM** (disarankan) | Production, isolasi pool, tuning worker |
| **mod_php** | Sederhana, resource lebih boros |

Contoh enable FPM + Apache:

```bash
sudo a2enmod proxy_fcgi setenvif
sudo a2enconf php8.5-fpm
sudo a2dismod php8.5   # jika sebelumnya mod_php
sudo systemctl enable --now php8.5-fpm
sudo systemctl restart apache2
```

---

## 6. Konfigurasi PHP production

Edit pool atau `php.ini` (contoh path):

```bash
# CLI / global
sudo nano /etc/php/8.5/fpm/php.ini
# atau
sudo nano /etc/php/8.5/apache2/php.ini
```

### 6.1 Nilai yang diselaraskan dengan app

```ini
date.timezone = Asia/Jakarta
display_errors = Off
expose_php = Off
error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED

post_max_size = 20M
upload_max_filesize = 20M
memory_limit = 200M
max_execution_time = 120
max_input_time = 120
max_file_uploads = 20

file_uploads = On
allow_url_fopen = On
allow_url_include = Off

session.use_strict_mode = 1
session.use_only_cookies = 1
session.cookie_httponly = 1
session.cookie_samesite = Lax
session.cookie_secure = 1
session.cookie_lifetime = 0
session.gc_maxlifetime = 1440
session.save_path = /var/lib/php/sessions

; OPcache
opcache.enable = 1
opcache.memory_consumption = 128
opcache.interned_strings_buffer = 16
opcache.max_accelerated_files = 10000
opcache.validate_timestamps = 1
opcache.revalidate_freq = 60
opcache.jit = 1255
opcache.jit_buffer_size = 64M
```

**Catatan:**

- `session.cookie_secure = 1` hanya jika HTTPS sudah aktif.
- `session.save_path` pastikan writable oleh user PHP (`www-data`).
- `magic_quotes_*` dan `register_globals` tidak relevan di PHP 8.5.

Restart:

```bash
sudo systemctl restart php8.5-fpm
# atau
sudo systemctl restart apache2
```

### 6.2 Verifikasi

```bash
php -i | grep -E 'date.timezone|display_errors|expose_php|upload_max|session.cookie'
```

Buat file uji singkat lalu hapus:

```bash
echo '<?php phpinfo();' | sudo tee /var/www/html/info.php
# buka https://domain/info.php lalu HAPUS file itu
sudo rm -f /var/www/html/info.php
```

---

## 7. Virtual host & document root

### 7.1 Struktur direktori

```bash
sudo mkdir -p /var/www/abdurrozak.my.id/public_html
sudo chown -R www-data:www-data /var/www/abdurrozak.my.id
```

### 7.2 Vhost HTTP (sebelum SSL)

```bash
sudo nano /etc/apache2/sites-available/abdurrozak.my.id.conf
```

```apache
<VirtualHost *:80>
    ServerName abdurrozak.my.id
    ServerAlias www.abdurrozak.my.id
    DocumentRoot /var/www/abdurrozak.my.id/public_html

    <Directory /var/www/abdurrozak.my.id/public_html>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/abdurrozak-error.log
    CustomLog ${APACHE_LOG_DIR}/abdurrozak-access.log combined
</VirtualHost>
```

```bash
sudo a2ensite abdurrozak.my.id.conf
sudo a2dissite 000-default.conf
sudo apache2ctl configtest
sudo systemctl reload apache2
```

---

## 8. SSL/TLS (Let's Encrypt)

WebAuthn/passkey **wajib HTTPS** (secure context).

```bash
sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache -d abdurrozak.my.id -d www.abdurrozak.my.id
```

Pastikan redirect HTTP → HTTPS aktif. Perpanjang otomatis:

```bash
sudo certbot renew --dry-run
```

### 8.1 TLS modern (opsional di vhost SSL)

```apache
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          HIGH:!aNULL:!MD5:!3DES
SSLHonorCipherOrder     off
```

---

## 9. Security headers Apache

App sudah mengirim banyak header dari PHP. Lapisan Apache sebagai cadangan:

```apache
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
    Header always set Cross-Origin-Opener-Policy "same-origin"
    Header always set Cross-Origin-Resource-Policy "same-origin"
    Header always set X-Permitted-Cross-Domain-Policies "none"
    Header always unset X-Powered-By

    # HSTS — hanya setelah HTTPS stabil
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>
```

**CSP:** lebih baik dibiarkan dari `index.php` (ada **nonce** per request). Jangan dobel CSP ketat di Apache yang menimpa nonce app, kecuali Anda paham menggabungkannya.

Simpan di vhost SSL atau di `.htaccess` (file `htaccess` bundle sudah berisi aturan cache + deny secret).

---

## 10. Firewall & fail2ban

```bash
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 'Apache Full'
sudo ufw enable
sudo ufw status
```

Fail2ban (dasar):

```bash
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban
```

Jail SSH contoh `/etc/fail2ban/jail.local`:

```ini
[sshd]
enabled = true
maxretry = 5
bantime = 1h
```

---

## 11. Deploy file aplikasi

### 11.1 File wajib di `public_html`

```text
index.php
index.js
index.css
dl_webauthn.php
.htaccess          ← rename dari htaccess
.env               ← dari env.example (jangan commit secret)
robots.txt         ← opsional
VERSION            ← opsional
```

### 11.2 Contoh upload

```bash
# dari mesin lokal
rsync -avz --exclude 'env' ./artifacts/ deploy@SERVER:/var/www/abdurrozak.my.id/public_html/
```

Di server:

```bash
cd /var/www/abdurrozak.my.id/public_html
mv htaccess .htaccess   # jika belum
cp env.example .env
nano .env               # isi secret
```

**Jangan** expose: `.env`, `.dirlister_*`, `.audit.log`, `dl_webauthn.php` lewat listing (sudah di-deny di `.htaccess` + exclude app).

---

## 12. File `.env` lengkap

```env
# --- Identitas ---
APPVER=v26.0911
SITE=abdurrozak.my.id
HOME_URL=https://abdurrozak.my.id/
APP_LANG=id

# --- Folder terkunci (env-level, permanen sampai diubah di sini) ---
LOCKED_FOLDERS=~SRVTKJ-DC
# Pilih SALAH SATU: plain (kurang ideal) atau bcrypt hash (lebih aman)
LOCKED_PASSWORD=ganti-dengan-password-kuat-min-12-karakter
# LOCKED_PASS_HASH=$2y$12$...

LOCKS_FILE=.dirlister_locks.php
LOCK_ADMIN_BYPASS=true
LOCK_UNLOCK_TTL=3600
STATIC_LOCK_GUARD=true

# --- Views / analytics ---
VIEWS_FILE=.dirlister_views.php
VIEWS_COOLDOWN=45
VIEWS_DELTA_MAX=32768
PRESENCE_TTL=75
EVENTS_MAX=40
SSE_SECONDS=45

# --- Alert keamanan ---
ALERT_WEBHOOK=
ALERT_EMAIL=admin@abdurrozak.my.id
ALERT_LOCK_FAIL_THRESHOLD=5

# --- WebSocket opsional (kosong = pakai SSE) ---
WS_URL=

# --- Share ---
SHARES_FILE=.dirlister_shares.php

# --- Cache CDN (sesuaikan jika dipakai) ---
# CDN_CACHE_STATIC=604800
```

Generate bcrypt hash (di server):

```bash
php -r "echo password_hash('password-anda', PASSWORD_BCRYPT, ['cost'=>12]), PHP_EOL;"
```

Lalu set `LOCKED_PASS_HASH=...` dan kosongkan `LOCKED_PASSWORD`.

---

## 13. Permission & kepemilikan

```bash
cd /var/www/abdurrozak.my.id/public_html
sudo chown -R www-data:www-data .
sudo find . -type d -exec chmod 755 {} \;
sudo find . -type f -exec chmod 644 {} \;
sudo chmod 600 .env
# file runtime akan dibuat app:
# .dirlister_locks.php, .dirlister_views.php, .dirlister_views.delta
# .dirlister_presence.json, .dirlister_events.json, .dirlister_devices.json
# .dirlister_shares.php, .dirlister_auth.php, .audit.log, .trash/
```

Pastikan user PHP bisa **menulis** di `public_html` (atau minimal file runtime di atas). Untuk hardening lebih ketat, directory writable terpisah — model app ini mengasumsikan write di base dir.

---

## 14. Fitur: folder lock & static guard

### 14.1 Cara kerja

1. Admin mengunci folder → password di-hash bcrypt → `.dirlister_locks.php`
2. App menulis `.htaccess` di dalam folder (marker `DIRLISTER-LOCK-GUARD`) berisi `Require all denied`
3. Listing/API memblokir sampai password unlock (session + TTL)
4. File dibuka lewat `?api=download&path=...` (bukan URL statis mentah)

### 14.2 Env lock vs lock dinamis

| Jenis | Cara lepas |
|-------|------------|
| `LOCKED_FOLDERS` di `.env` | Hapus dari `.env`, reload PHP |
| Lock admin (UI) | Tombol buka kunci (admin) |

### 14.3 Verifikasi guard

```bash
ls -la /var/www/abdurrozak.my.id/public_html/~SRVTKJ-DC/.htaccess
curl -I https://abdurrozak.my.id/~SRVTKJ-DC/
# diharapkan 403
```

---

## 15. Fitur: WebAuthn / passkey

1. HTTPS aktif
2. OpenSSL di PHP aktif
3. `dl_webauthn.php` di folder yang sama dengan `index.php`
4. Login page → **LOGIN DENGAN PASSKEY**
5. Admin → daftar passkey (Ctrl+K / panel user)

Browser: Chrome/Edge/Safari modern, authenticator platform atau security key.

---

## 16. Fitur: TOTP 2FA

1. Login sebagai admin
2. Ctrl+K → aktifkan 2FA → scan secret di Authenticator
3. Saat login password, isi field **2FA / TOTP**

Disable lewat API/action disable (admin).

---

## 17. Fitur: views, presence, device analytics

| Data | File |
|------|------|
| Hit views (delta + compact) | `.dirlister_views.php` + `.delta` |
| Online presence | `.dirlister_presence.json` |
| Event feed | `.dirlister_events.json` |
| Agregat perangkat | `.dirlister_devices.json` |

Panel: **Analitik real-time** (admin). Badge header menampilkan online + channel (`SSE` / `WS` / `POLL`).

Kolom **VIEW** di tabel details = jumlah buka path (cooldown anti-spam).

---

## 18. Realtime: SSE & WebSocket opsional

### 18.1 Default (tanpa instal tambahan)

- **SSE:** `?api=stream` (push ~2 detik, loop ~45 detik, auto-reconnect)
- Fallback: poll presence

### 18.2 WebSocket terpisah (opsional)

```bash
# Node 20+ 
sudo apt install -y nodejs npm
cd /opt
sudo npm install ws
# salin ws-gateway.example.mjs
node ws-gateway.example.mjs
```

Di `.env`:

```env
WS_URL=wss://ws.abdurrozak.my.id
```

Produksi: letakkan di belakang reverse proxy TLS (Apache/Nginx) sebagai `wss://`.

---

## 19. CDN (Cloudflare / Akamai)

- **HTML / API** (`index.php`): **no-store** (jangan cache halaman login/list dinamis)
- **Aset statis** (`index.css`, `index.js`): cache panjang + version query `?v=`

Ikuti file:

- `cloudflare-cache-rules.txt`
- `akamai-cache-guide.txt`
- header di `.htaccess`

Jika Cloudflare “Cache Everything” aktif, buat **Bypass** untuk `/` dan `*api=*`.

---

## 20. Tuning Apache

### 20.1 MPM event (disarankan dengan PHP-FPM)

```bash
sudo a2dismod mpm_prefork
sudo a2enmod mpm_event
sudo systemctl restart apache2
```

`/etc/apache2/mods-available/mpm_event.conf` contoh VPS 2 GB:

```apache
ServerLimit             8
StartServers            2
MinSpareThreads         25
MaxSpareThreads         75
ThreadsPerChild         25
MaxRequestWorkers       200
MaxConnectionsPerChild  1000
```

### 20.2 Kompresi & cache aset

Pastikan `mod_deflate` + `mod_expires` aktif (sudah di `.htaccess` bundle untuk static).

### 20.3 Timeout

```apache
Timeout 120
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
```

SSE memakai koneksi lebih lama; 120s selaras `max_execution_time`.

---

## 21. Tuning PHP-FPM

`/etc/php/8.5/fpm/pool.d/www.conf` contoh:

```ini
pm = dynamic
pm.max_children = 20
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 6
pm.max_requests = 500
request_terminate_timeout = 120
```

Hitung kasar: `max_children × memory_per_script < RAM tersedia`.

```bash
sudo systemctl restart php8.5-fpm
```

---

## 22. Tuning sistem (sysctl, disk, log)

### 22.1 sysctl singkat

```bash
sudo nano /etc/sysctl.d/99-dirlister.conf
```

```conf
net.core.somaxconn = 1024
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_reuse = 1
vm.swappiness = 10
```

```bash
sudo sysctl --system
```

### 22.2 Disk

- Pantau inode & space: `df -h`, `df -i`
- Folder `.trash` & log audit bisa membesar → jadwalkan pembersihan

### 22.3 Open files

```bash
# opsional di service override
LimitNOFILE=65535
```

---

## 23. Backup & rotasi log

### 23.1 Yang dibackup

```text
.env
.dirlister_auth.php
.dirlister_locks.php
.dirlister_ket.php
.dirlister_views.php
public_html (kode + data user)
```

Contoh cron harian:

```bash
0 3 * * * tar -czf /backup/dirlister-$(date +\%F).tgz -C /var/www/abdurrozak.my.id public_html
```

### 23.2 Log Apache

Rotasi default `logrotate` Ubuntu biasanya sudah ada untuk `/var/log/apache2/`.

### 23.3 Audit app

File `.audit.log` — arsipkan / potong berkala agar tidak membengkak.

---

## 24. Checklist uji pasca-deploy

- [ ] `https://domain/` load CSS/JS (bukan halaman polos)
- [ ] `date.timezone` Jakarta (timestamp audit benar)
- [ ] Login admin / setup user pertama
- [ ] Kunci folder → muncul badge LOCK
- [ ] URL langsung ke file di folder locked → **403**
- [ ] Setelah unlock session → unduh lewat app berhasil
- [ ] Kolom VIEW bertambah setelah buka folder/file
- [ ] Badge online + channel SSE
- [ ] Panel analitik (device mobile/desktop)
- [ ] Passkey (opsional) di HTTPS
- [ ] TOTP (opsional)
- [ ] Hard refresh Ctrl+F5 setelah update aset

Selftest (hanya admin / token):

```text
https://domain/index.php?selftest=1
```

---

## 25. Troubleshooting

| Gejala | Cek |
|--------|-----|
| CSS/JS 404 | Path `public_html`, permission, URL |
| `.htaccess` diabaikan | `AllowOverride All`, `mod_rewrite` |
| Folder locked masih bisa di-URL | Guard `.htaccess` ada? `STATIC_LOCK_GUARD=true`? |
| Passkey gagal | HTTPS? OpenSSL? `dl_webauthn.php` ter-upload? |
| Session hilang | `session.save_path` writable? `cookie_secure` tanpa HTTPS? |
| SSE putus terus | Proxy/CDN buffer; `SSE_SECONDS`; `max_execution_time` |
| Upload gagal | `upload_max_filesize` vs `post_max_size` |
| 500 setelah edit `.env` | Syntax `.env`, permission 600, error log Apache |
| Permission denied write | `chown www-data`, chmod directory |

Log:

```bash
sudo tail -f /var/log/apache2/abdurrozak-error.log
sudo tail -f /var/log/php8.5-fpm.log
```

---

## 26. Keamanan operasional

1. Jangan commit `.env` ke git publik  
2. Password lock & admin minimal 12 karakter unik  
3. Nonaktifkan listing directory (`Options -Indexes`)  
4. Hapus `phpinfo` / file uji  
5. Update Ubuntu rutin: `apt update && apt upgrade`  
6. Pantau `lock_fail` (email/webhook)  
7. Batasi SSH key-only, nonaktifkan password login jika memungkinkan  
8. Backup teruji restore  

---

## Lampiran A — Perintah ringkas end-to-end

```bash
# 1. Sistem
sudo apt update && sudo apt full-upgrade -y
sudo timedatectl set-timezone Asia/Jakarta

# 2. Apache + PHP
sudo apt install -y apache2 php8.5 php8.5-fpm php8.5-cli \
  php8.5-mbstring php8.5-xml php8.5-curl php8.5-zip php8.5-gd
sudo a2enmod rewrite headers expires deflate ssl proxy_fcgi
sudo a2enconf php8.5-fpm
sudo systemctl enable --now apache2 php8.5-fpm

# 3. Situs
sudo mkdir -p /var/www/abdurrozak.my.id/public_html
# upload file app → public_html
# set .env, .htaccess, chmod 600 .env

# 4. SSL
sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache -d abdurrozak.my.id

# 5. Firewall
sudo ufw allow OpenSSH
sudo ufw allow 'Apache Full'
sudo ufw enable
```

---

## Lampiran B — Mapping fitur → file runtime

| Fitur | File runtime |
|-------|----------------|
| Auth users | `.dirlister_auth.php` |
| Lock dinamis | `.dirlister_locks.php` |
| Keterangan | `.dirlister_ket.php` |
| Views | `.dirlister_views.php`, `.dirlister_views.delta` |
| Presence | `.dirlister_presence.json` |
| Events | `.dirlister_events.json` |
| Devices | `.dirlister_devices.json` |
| Shares | `.dirlister_shares.php` |
| Audit | `.audit.log` |
| Trash | `.trash/` |
| Static guard | `{folder}/.htaccess` |

---

## Lampiran C — Kompatibilitas versi

| Komponen | Minimum | Diuji/target panduan |
|----------|---------|----------------------|
| PHP | 7.4+ | **8.5.9** |
| Apache | 2.4 (Require) | **2.4.68** |
| Ubuntu | 22.04+ | **26.04** |
| Browser | Modern ES6 | Chrome / Firefox / Safari / Edge terkini |

---

*Dokumen ini menyertai bundle DIR//LISTER v26.0911. Sesuaikan nama domain, path, dan resource VPS dengan lingkungan Anda.*