# Nerdy AnS Panel - Apache protection
# Keep this file in the panel root.

# Never show directory/file listings.
Options -Indexes

# Use the panel entry point when visiting the directory itself.
DirectoryIndex index.php

# Block direct browser access to sensitive application/storage files.
<FilesMatch "^(?:config\.php|README(?:\.[A-Za-z0-9._-]+)?|.*\.(?:json|log|sql|sqlite|db|bak|backup|old|orig|tmp|ini|env|dist|sh))$">
    Require all denied
</FilesMatch>

# Block dotfiles (.env, .git, .htaccess, etc.).
# Apache normally protects .htaccess already, but this protects other hidden files too.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Explicitly deny the private data directory even if a file type changes later.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^data(?:/|$) - [F,L,NC]
</IfModule>

# Prevent content sniffing on responses when mod_headers is available.
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "same-origin"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>
