GitLab

web/index.html was the 368-line "Apache2 Debian Default Page" that ships in the
base OS package. Nothing referenced it and it was already excluded from the built
image, so its only effects were a permanent gap in the staging drift check and a
recurring pair of plaintext-http-link findings in every security scan, from the
http:// documentation links it carries to httpd.apache.org and bugs.debian.org.

Deleting it clears both findings at the source rather than by suppression, and
closes the drift gap (down from two known gaps to one). There is no runtime
effect because the image never contained the file; / continues to resolve through
index.php to the login redirect. Confirmed empirically that an index.html at the
docroot would not have shadowed index.php anyway, since the vhost
DirectoryIndex (index.php first, 000-default.conf) takes precedence over the
Debian global in mods-enabled/dir.conf - but an unused vendor page is still worth
removing rather than blanking.

The unrelated zero-byte sql_updates/index.html, which suppresses directory
listing, is deliberately kept.