<IfModule mod_rewrite.c>
    RewriteEngine On

    # Allow ACME /.well-known
    RewriteRule ^\.well-known/ - [L]

    # Block access to sensitive paths
    RewriteRule ^(\.|app/|bootstrap/|config/|database/|resources/|routes/|storage/|vendor/|node_modules/|tests/|extractor/|docker/|scripts/) - [F,L]

    # Send everything to public/ (internal rewrite)
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ /public/$1 [L]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Options -Indexes
