# BuCMS — Apache configuration & hardening

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Admin panel → admin/index.php
    RewriteRule ^admin(/.*)?$ admin/index.php [L,QSA]

    # Installer
    RewriteRule ^install(/.*)?$ install/index.php [L,QSA]

    # Static assets served directly
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^public/ - [L]

    # Everything else → front controller
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L]
</IfModule>

# Block access to config, storage, app source, vendor, and module internals.
RedirectMatch 403 ^/?(config|storage|app|vendor|tests|node_modules)(/|$)

# Deny sensitive file types anywhere.
<FilesMatch "\.(env|log|json|lock|md|dist|sql|sqlite|db|ini|yml|yaml|sh|bak|old|swp|inc)$">
    Require all denied
</FilesMatch>

# Allow the manifests that MUST be web-readable? No — manifests are read
# server-side only, so denying .json above is safe for the front controller.

# Disable directory listing and limit HTTP methods.
Options -Indexes -ExecCGI
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|DEBUG)$
    RewriteRule .* - [F]
</IfModule>

# Never execute PHP inside upload/storage paths (defence in depth).
<IfModule mod_rewrite.c>
    RewriteRule ^(.*/)?uploads/.*\.(php|phtml|phar|pht)$ - [F]
    # Plugin/theme PHP files are only ever included by the core, never called
    # directly over HTTP. Block direct requests to them (a leaked/injected .php
    # inside a module cannot be triggered from the browser).
    RewriteRule ^(plugins|themes)/.*\.(php|phtml|phar|pht|php3|php4|php5|php7)$ - [F]
</IfModule>

# Security headers (in addition to PHP-set headers)
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header always unset X-Powered-By
    Header always unset Server
</IfModule>

# Prevent access to dotfiles (.git, .env, .htaccess itself, etc.)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Block VCS metadata directories outright (.git/, .svn/, .hg/) and their contents.
RedirectMatch 403 ^/?\.(git|svn|hg)(/|$)

# Explicitly protect the front-controller-only PHP entrypoints from odd access.
<FilesMatch "(config\.php|config\.sample\.php)$">
    Require all denied
</FilesMatch>
