Why the GLPI 10 DocumentRoot must point at the public folder: what gets exposed when it does not, a hardened Apache and Nginx virtual host, a verification script and the NexTool maintenance production checklist.