# Disable directory browsing
Options -Indexes

# Disable server signature
ServerSignature Off

# ----------------------------------------------------------------------
# Block access to hidden dotfiles (.DS_Store, .git, etc.)
# Files inside .well-known/ (e.g. Let's Encrypt challenges) are not
# affected because their filenames do not start with a dot.
# ----------------------------------------------------------------------
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ----------------------------------------------------------------------
# Text compression (HTML, CSS, JS, SVG, JSON, ...)
# ----------------------------------------------------------------------
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
    AddOutputFilterByType DEFLATE application/xml application/xhtml+xml application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript application/json application/manifest+json
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# ----------------------------------------------------------------------
# Browser caching for static assets
# (site.css / site.js are cache-busted with a ?v= query string in views)
# ----------------------------------------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 week"
    ExpiresByType text/css "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType image/webp "access plus 6 months"
    ExpiresByType image/png "access plus 6 months"
    ExpiresByType image/jpeg "access plus 6 months"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 month"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

# ----------------------------------------------------------------------
# Security headers
# Replace any Content-Security-Policy set at the server level with the
# policy this site actually needs (self + Google Fonts + Font Awesome).
# ----------------------------------------------------------------------
<IfModule mod_headers.c>
    Header unset Content-Security-Policy
    Header always unset Content-Security-Policy
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests"
</IfModule>

# ----------------------------------------------------------------------
# Rewrite engine
# ----------------------------------------------------------------------
<IfModule mod_rewrite.c>
	Options +FollowSymlinks
	RewriteEngine On

	# Force HTTPS and the canonical (non-www) host in a single 301.
	# (If this app is ever placed behind a TLS-terminating proxy, check
	#  the X-Forwarded-Proto header instead of %{HTTPS} to avoid loops.)
	RewriteCond %{HTTPS} !=on [OR]
	RewriteCond %{HTTP_HOST} !^mboardapp\.com$ [NC]
	RewriteRule ^ https://mboardapp.com%{REQUEST_URI} [R=301,L]

	# Redirect Trailing Slashes...
	RewriteCond %{REQUEST_FILENAME} !-d
	RewriteCond %{REQUEST_URI} (.+)/$
	RewriteRule ^ %1 [L,R=301]

	# Checks to see if the user is attempting to access a valid file,
	# such as an image or css document, if this isn't true it sends the
	# request to the front controller, index.php
	RewriteCond %{REQUEST_FILENAME} !-f
	RewriteCond %{REQUEST_FILENAME} !-d
	RewriteRule ^([\s\S]*)$ index.php/$1 [L,NC,QSA]

	# Ensure Authorization header is passed along
	RewriteCond %{HTTP:Authorization} .
	RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

<IfModule !mod_rewrite.c>
	# If we don't have mod_rewrite installed, all 404's
	# can be sent to index.php, and everything works as normal.
	ErrorDocument 404 index.php
</IfModule>
