# Disable directory browsing
Options -Indexes

# ----------------------------------------------------------------------
# Rewrite engine
# ----------------------------------------------------------------------

# Turning on the rewrite engine is necessary for the following rules and features.
# FollowSymLinks must be enabled for this to work.
<IfModule mod_rewrite.c>
	Options +FollowSymlinks
	RewriteEngine On

	# If you installed CodeIgniter in a subfolder, you will need to
	# change the following line to match the subfolder you need.
	# http://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewritebase
	# RewriteBase /

	# ---------------------------------------------------------------
	#  AUTO-FIX: collapse doubled subfolder in the URL.
	#  If the request URL has a doubled subfolder (e.g. /rajpath/rajpath/...)
	#  redirect to the outer (single-folder) URL with 301.
	# ---------------------------------------------------------------
	RewriteCond %{REQUEST_URI} ^/([^/]+)/\1(/.*)?$ [NC]
	RewriteRule ^ /%1%2 [L,R=301,NE]

	# Redirect Trailing Slashes...
	RewriteCond %{REQUEST_FILENAME} !-d
	RewriteCond %{REQUEST_URI} (.+)/$
	RewriteRule ^ %1 [L,R=301]

	# Rewrite "www.example.com -> example.com"
	RewriteCond %{HTTPS} !=on
	RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
	RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L]

	# Checks to see if the user is attempting to access a valid file,
	# such as an image or css document, if this isn't true it sends the
	# request to the front controller, index.php
	RewriteCond %{REQUEST_FILENAME} !-f
	RewriteCond %{REQUEST_FILENAME} !-d
	RewriteRule ^([\s\S]*)$ index.php/$1 [L,NC,QSA]

	# Ensure Authorization header is passed along
	RewriteCond %{HTTP:Authorization} .
	RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

<IfModule !mod_rewrite.c>
	# If we don't have mod_rewrite installed, all 404's
	# can be sent to index.php, and everything works as normal.
	ErrorDocument 404 index.php
</IfModule>

# Disable server signature start
ServerSignature Off
# Disable server signature end

# =============================================================
#  Security Headers
# =============================================================
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# =============================================================
#  Production lockdown for browser-accessible deploy tools
#  ---------------------------------------------------------
#  These scripts MUST be denied once the server is past its first-time
#  install.  In emergency (broken install / lost credentials), the
#  operator can re-enable them with:
#     sudo a2enmod rewrite  &&  sudo systemctl restart apache2
#     sed -i 's/Require all denied/Require all granted/' \
#         /var/www/rajpath/public/.htaccess
#  …do the install, then revert.
#
#  install.php and debug-login.php are INTENTIONALLY 404 on production.
# =============================================================
<FilesMatch "(install|fix-db|debug-login|login-check)\.php$">
    Require all denied
</FilesMatch>
<FilesMatch "server-diagnostics-web\.php$">
    # Operator must add their IP here to use the diagnostic page remotely.
    # Leave localhost-only in production.
    Require local
</FilesMatch>

# =============================================================
#  Compression & Caching
# =============================================================
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript
    AddOutputFilterByType DEFLATE application/javascript application/json
    AddOutputFilterByType DEFLATE image/svg+xml font/ttf font/eot font/otf font/woff font/woff2
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg     "access plus 1 year"
    ExpiresByType image/jpeg    "access plus 1 year"
    ExpiresByType image/png     "access plus 1 year"
    ExpiresByType image/gif     "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType text/css      "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType font/woff2    "access plus 1 year"
</IfModule>
