# ADEBLED FixIT — document root.
#
# The application lives one level up (fixit/includes, fixit/storage, fixit/bin)
# and the subdomain's document root points here, so none of that is reachable
# by URL. This file is the second line of defence for the case where the
# document root is set to the application root by mistake — the single most
# likely cPanel setup error.

# ---------------------------------------------------------------------
# Directory listings
# ---------------------------------------------------------------------
Options -Indexes -ExecCGI
DirectoryIndex index.php index.html

# ---------------------------------------------------------------------
# Force HTTPS. Comment this block out until AutoSSL has issued, or the
# site will redirect to a certificate that does not exist yet.
# ---------------------------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>

# ---------------------------------------------------------------------
# Nothing here is servable but the app itself.
# ---------------------------------------------------------------------

# Dotfiles: .env, .git, .htpasswd, editor leftovers.
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# Source, data and documentation that must never be downloadable.
<FilesMatch "\.(md|sql|yml|yaml|log|ini|json|lock|sh|bak|old|orig|swp|dist|sample)$">
  Require all denied
</FilesMatch>

# config.php can only ever appear here through a deployment mistake.
<FilesMatch "^config\.php$">
  Require all denied
</FilesMatch>

# The API preamble is an include, not an endpoint. It defends itself with
# a FIXIT_API constant check too; this makes it unreachable regardless.
<FilesMatch "^_">
  Require all denied
</FilesMatch>

# ---------------------------------------------------------------------
# Headers. PHP sets these itself for pages it renders; these cover static
# assets and any response PHP never reaches.
# ---------------------------------------------------------------------
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always unset X-Powered-By
  Header always unset Server

  # Long cache for fingerprinted assets — every asset URL carries ?v=mtime.
  <FilesMatch "\.(css|js|woff2?|svg)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
</IfModule>

# ---------------------------------------------------------------------
# Upload and request limits. The app accepts no file uploads at all, so
# these are deliberately small.
# ---------------------------------------------------------------------
<IfModule mod_php.c>
  php_value upload_max_filesize 1M
  php_value post_max_size 2M
  php_value max_execution_time 30
  php_flag display_errors Off
  php_flag expose_php Off
</IfModule>

# Generic error pages, so a raw server error never shows a path.
ErrorDocument 403 "Forbidden"
ErrorDocument 404 "Not found"
