# ============================================================
# XUNTU — Apache .htaccess
# ============================================================

Options -Indexes
Options -MultiViews

# ── Engine ────────────────────────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /Xuntu/

    # Block direct access to sensitive directories
    RewriteRule ^(config|includes|storage|database)/  - [F,L]

    # Allow legitimate asset requests to pass
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
</IfModule>

# ── Block PHP execution in uploads ───────────────────────────────
<IfModule mod_rewrite.c>
    RewriteRule ^uploads/.*\.(php|phtml|php3|php4|php5|phps|cgi|pl|py)$ - [F,L]
</IfModule>

# ── Protect .htaccess and sensitive files ────────────────────────
<FilesMatch "^(\.htaccess|\.htpasswd|\.env|composer\.(json|lock)|package\.json|README\.md|.*\.sql)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# ── Security headers ──────────────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# ── GZIP compression ──────────────────────────────────────────────
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css
    AddOutputFilterByType DEFLATE application/xml application/xhtml+xml application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript
    AddOutputFilterByType DEFLATE application/json image/svg+xml
</IfModule>

# ── Browser caching ───────────────────────────────────────────────
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpeg           "access plus 1 year"
    ExpiresByType image/png            "access plus 1 year"
    ExpiresByType image/webp           "access plus 1 year"
    ExpiresByType image/svg+xml        "access plus 1 year"
    ExpiresByType image/x-icon         "access plus 1 year"
    ExpiresByType text/css             "access plus 6 months"
    ExpiresByType application/javascript "access plus 6 months"
    ExpiresByType application/x-font-ttf "access plus 1 year"
    ExpiresByType font/woff2           "access plus 1 year"
    ExpiresByType text/html            "access plus 0 seconds"
</IfModule>

# ── Charset ───────────────────────────────────────────────────────
AddDefaultCharset UTF-8

# ── Custom error pages ────────────────────────────────────────────
ErrorDocument 404 /Xuntu/404.php
ErrorDocument 403 /Xuntu/404.php
ErrorDocument 500 /Xuntu/404.php
