# NetUp Africa — Apache configuration (document root = this "public" folder)

Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Never serve hidden files (.env, .git…)
    RewriteRule (^|/)\. - [F,L]

    # Static files are served directly, everything else goes to the front controller
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ - [L]
    RewriteRule ^ index.php [L,QSA]
</IfModule>

# Error pages of the original site
ErrorDocument 400 /error-400-bad-request-2/
ErrorDocument 401 /error-401-authentication-required-2/
ErrorDocument 403 /error-403-forbidden/

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    <FilesMatch "\.(css|js|svg|png|jpe?g|gif|webp|ico|woff2?)$">
        Header set Cache-Control "public, max-age=2592000"
    </FilesMatch>
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json image/svg+xml text/xml application/xml
</IfModule>

# router.php is only for PHP's built-in development server
<Files "router.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</Files>
