WebServer/run/rules.json

{
  "allow": [
    "index.html",
    "css/*",
    "private/info.php"
  ],
  "deny": [
    "private/*"
  ],
  "auth": [
    "private/*",
    "admin/*"
  ]
}