62 lines
2.0 KiB
ApacheConf

# Enable mod_rewrite
RewriteEngine On
# Security headers
# The first rule is to prevent including in a frame on a different domain.
# Remove it if you want to do that.
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"
# Directory index
DirectoryIndex index.php
# Deny access to hidden files (e.g. .htaccess)
<FilesMatch "^\.">
Require all denied
</FilesMatch>
# Cache static files (excluding css/custom which goes through PHP)
# Note that I don't actually serve most of this (just css)
# but this prevents requests for static content from getting to the PHP handler.
#
# The /css/custom directory is excluded from this in a RewriteCond below:
# RewriteCond %{REQUEST_URI} !^/tkr/css/custom/
#
# Those requests are handled by the PHP app to serve custom css
<FilesMatch "\.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header set Cache-Control "public, max-age=31536000, immutable"
</FilesMatch>
# Process PHP files
<FilesMatch "\.php$">
SetHandler application/x-httpd-php
</FilesMatch>
# Skip rewriting if already in /tkr/public/ (prevents infinite loops)
RewriteRule ^tkr/public/ - [L]
# Block direct access to all .php files
# but allow internal rewrites to index.php
RewriteCond %{THE_REQUEST} \.php [NC]
RewriteRule ^.*\.php$ - [R=404,L]
# Block access to sensitive directories under /tkr
RewriteRule ^tkr/(storage|src|templates|uploads|config)(/.*)?$ - [F,L]
# Handle /tkr requests
# (keep the path after /tkr for the next directive)
RewriteCond %{REQUEST_URI} ^/tkr(/.*)?$
# If it's a static file that exists in /tkr/public, serve it directly
# (e.g. /tkr/public/css/tkr.css)
RewriteCond %{REQUEST_URI} !^/tkr/css/custom/
RewriteCond %{DOCUMENT_ROOT}/tkr/public%1 -f
RewriteRule ^tkr(/.*)?$ /tkr/public$1 [L]
# Send everything else to the front controller
# (/tkr/public/index.php)
RewriteRule ^tkr(/.*)?$ /tkr/public/index.php [L]