# ============================================================
# Project root — forward all traffic into public/
# (cPanel: upload the project contents into public_html,
#  or point the domain document root to .../public/)
# ============================================================

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    RewriteRule ^$ public/ [L]
    RewriteRule (.*) public/$1 [L]
</IfModule>

# Never serve application internals directly
<FilesMatch "\.(env|log|sql|md|json|lock)$">
    Require all denied
</FilesMatch>

# ============================================================
# Security headers
# ============================================================
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS
</IfModule>

Options -Indexes
ServerSignature Off
