# Celena CMS — Apache rewrite rules
Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Public documentation section (/docs) — served by the app (plugin handbook),
    # even though a real docs/ dir exists in the repo. Must come BEFORE the
    # sensitive-dirs rule and the existing-dir check, otherwise the physical
    # docs/ folder shadows the route (403 / directory).
    RewriteRule ^docs(/.*)?$ index.php [L,QSA]

    # Forbid direct access to sensitive directories
    RewriteRule ^(core|modules|config|storage|tests|bin|docs)/ - [F,L]
    RewriteRule (^|/)\.(env|git|htaccess|htpasswd) - [F,L]

    # Existing files / directories are served as is
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Admin
    RewriteRule ^admin(/.*)?$ admin.php [L,QSA]

    # Everything else through front controller
    RewriteRule ^ index.php [L,QSA]
</IfModule>

<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    # Разрешены только собственные ресурсы сайта. Подключаете сторонний сервис
    # (Google Analytics/Ads, чат, шрифты, видео) — допишите его домены в нужную
    # директиву: script-src / style-src / frame-src / connect-src.
    Header set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; media-src 'self' https:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self' https:; frame-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"
    # HSTS включаем только для HTTPS-запросов.
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains" "expr=%{HTTPS} == 'on'"
</IfModule>

# Долгий кэш статики (картинки/CSS/JS/шрифты/видео) — скорость + repeat-visits (PageSpeed).
<IfModule mod_headers.c>
    <FilesMatch "\.(jpg|jpeg|png|gif|webp|svg|ico|css|js|woff2?|ttf|mp4)$">
        Header set Cache-Control "public, max-age=2592000"
    </FilesMatch>
</IfModule>

<FilesMatch "\.(env|json|md|tpl|sql|log)$">
    Require all denied
</FilesMatch>

# Запретить выполнение PHP в директории загрузок (defense-in-depth).
# ВАЖНО: <Directory> и php_flag НЕ допускаются в .htaccess при PHP-FPM (Apache 500).
# Поэтому блокируем загрузочные PHP только через mod_rewrite ниже.
<IfModule mod_rewrite.c>
    RewriteRule ^public/uploads/.*\.(php|phar|phtml|phps|pht|inc)$ - [F,L,NC]
</IfModule>
<FilesMatch "(?i)\.(phar|phtml|phps|pht)$">
    Require all denied
</FilesMatch>
