Disallow remote access to Tomcat Manager?

According to the Tomcat7 docs, I can add a valve to prevent access to the Tomcat Manager app except from localhost:

<Context privileged="开发者_开发技巧true">
    <Valve className="org.apache.catalina.valves.RemoteAddrValve"
        allow="127\.0\.0\.1"/>
</Context>

The docs are not so helpful in explaining where that snippet of XML is supposed to go.

Can someone help me with this, please?

You modify CATALINA_HOME/conf/Catalina/localhost/manager.xml to add the filter to allow only local access (as in your post) or specific IPs

Add the valve within the Context tag of the manager.xml