# TrafficGate — Apache configuration.
# If you use nginx, see docs/deployment.md for the equivalent rules.
Options -Indexes
DirectoryIndex index.php index.html

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "no-referrer"
</IfModule>

# Never serve application source, tooling, tests, docs or data over HTTP.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^(?:src|bin|docs|tests|data|spec)(?:/|$) - [R=404,L]
  RewriteRule \.(?:sqlite|sqlite-wal|sqlite-shm|log|lock|bak|tmp)$ - [R=404,L]
  RewriteRule ^(?:\.git|\.env) - [R=404,L]
</IfModule>
<IfModule !mod_rewrite.c>
  RedirectMatch 404 ^/(?:src|bin|docs|tests|data|spec)(?:/|$)
  RedirectMatch 404 ^/.*\.(?:sqlite|sqlite-wal|sqlite-shm|log|lock|bak|tmp)$
  RedirectMatch 404 ^/(?:\.git|\.env)
</IfModule>

# Admin SPA is static; no rewrite needed. Click router is /index.php via query string.
