# ============================================================================
#  Ghana @70 - root .htaccess
#
#  Only Apache reads this file. This project is served locally by Herd, which
#  uses nginx, and nginx ignores .htaccess completely - so nothing here changes
#  the local site. It matters on a shared Apache host, where the document root
#  is usually the project folder rather than public/.
#
#  The public/.htaccess that Laravel ships handles the routing once requests
#  arrive inside public/. This file's job is different: deny what must never be
#  fetched, and send everything else into public/.
# ============================================================================

# ---------------------------------------------------------------------------
#  1. Deny, before anything is rewritten.
#
#  With an empty file here and the document root at the project folder, these
#  were fetchable over HTTP:
#
#      /.env                APP_KEY, database password, mail credentials
#      /.git/config         the whole repository history
#      /composer.json       installed package versions
#      /storage/logs/*.log  stack traces, sometimes with credentials in them
#      /*.sql               database backups
#
#  The rewrite below would otherwise hand them to public/ and let Apache serve
#  whatever it found there.
# ---------------------------------------------------------------------------

<FilesMatch "(^\.env|^\.env\..*|^\.git.*|^composer\.(json|lock)$|^package(-lock)?\.json$|^artisan$|^phpunit\.xml.*$|^\.user\.ini$|.*\.(sql|sqlite|log|bak|old|orig|swp|dist))$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# The same for the directories that hold them.
RedirectMatch 404 ^/(\.git|\.env|vendor/.*\.(json|lock|dist)|database/backups|storage/logs)

# No directory listings anywhere - an index-less folder should 403, not print
# a file list.
Options -Indexes -MultiViews

# ---------------------------------------------------------------------------
#  2. Send every request into public/.
#
#  This is what makes the app work when the document root is the project
#  folder. Requests already inside public/ are untouched, and real files are
#  served as they are.
# ---------------------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Already inside public? Leave it alone.
    RewriteCond %{REQUEST_URI} !^/public/

    # A real file or folder at the root (public/ itself, for instance) is not
    # rewritten.
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    RewriteRule ^(.*)$ public/$1 [L]

    # Pass the Authorization header through, for API tokens.
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

# ---------------------------------------------------------------------------
#  3. Upload limits, for Apache hosts running PHP as a module.
#
#  These duplicate public/.user.ini on purpose. .user.ini is read by PHP-FPM;
#  php_value is read by mod_php, and a host may use either. The uploads this
#  site needs - an 8MB programme, a 5MB banner - are above PHP's 2MB default,
#  so without one of these the server refuses the request with a bare 413
#  before Laravel sees it.
#
#  Guarded by IfModule: php_value is not understood when PHP runs through CGI
#  or FPM, and an unguarded directive would take the whole site down with a
#  500 instead.
# ---------------------------------------------------------------------------
<IfModule mod_php.c>
    php_value upload_max_filesize 32M
    php_value post_max_size 32M
    php_value memory_limit 256M
    php_value max_file_uploads 20
</IfModule>
<IfModule mod_php7.c>
    php_value upload_max_filesize 32M
    php_value post_max_size 32M
    php_value memory_limit 256M
    php_value max_file_uploads 20
</IfModule>
<IfModule mod_php8.c>
    php_value upload_max_filesize 32M
    php_value post_max_size 32M
    php_value memory_limit 256M
    php_value max_file_uploads 20
</IfModule>

# ---------------------------------------------------------------------------
#  4. Compression and caching for the built assets.
# ---------------------------------------------------------------------------
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
    AddOutputFilterByType DEFLATE application/javascript application/json
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType image/png "access plus 6 months"
    ExpiresByType image/jpeg "access plus 6 months"
    ExpiresByType image/webp "access plus 6 months"
    ExpiresByType image/svg+xml "access plus 6 months"
</IfModule>

# Send UTF-8 explicitly: the visitor pages carry Chinese and French.
AddDefaultCharset UTF-8
