Ensure no write access is granted to others

manifests/init.pp

@@ -11,6 +11,7 @@
 # @param comptoir_db_password PAssword for the user of the database
 # @param comptoir_db_host Name of the database host, must an FQDN or an IP address
 # @param comptoir_db_port Port of the database host, must an integer
+# @param apache_user System user running Apache, typically www-data
 #
 # @example
 #   include comptoir
@@ -26,6 +27,7 @@ class comptoir (
   String $comptoir_db_password         = 'comptoir',
   String $comptoir_db_host             = 'localhost',
   String $comptoir_db_port             = '5432',
+  String $apache_user                  = 'www-data',
   Boolean $debug                       = false,
 ) {
 
@@ -105,11 +107,20 @@ class comptoir (
   }
 
   # Comptoir configuration: COMPTOIR.PHP
-  -> file { 'Comptoir COMPTOIR.PHP creation':
+  file { 'Comptoir COMPTOIR.PHP creation':
     ensure  => present,
     path    => $_file_comptoir_php,
     content => template('comptoir/comptoir.php.epp'),
     owner   => $comptoir_user,
+    require => Exec['Install app with Composer'],
+  }
+
+  file { 'Chmod -R o-w':
+    ensure  => directory,
+    path    => $comptoir_dir,
+    mode    => 'o-w',
+    recurse => true,
+    require => Exec['Install app with Composer'],
   }
 
 }