# Powered by INKRAH.com | Developed by INKRAH Web Design | https://inkrah.com
# INKRAH Web Design Open Source Project for Wiki Portal
#
# Every request is funnelled through index.php (or admin/index.php),
# so no visitor ever learns the real name of a file or folder.
# Quod erat demonstrandum: what needed hiding, is hidden.

Options -Indexes -MultiViews
RewriteEngine On

# Never expose config.php, schema, or the sqlite file itself
<FilesMatch "\.(sql|sqlite|db)$">
  Require all denied
</FilesMatch>
<Files "config.php">
  Require all denied
</Files>

# Let real static assets, uploads, and the API endpoints through untouched.
# This MUST come before the blocking rule below, or it never gets reached.
# Matched by trailing path (not anchored to the domain root), so this
# still works whether the CMS lives at the root or several folders deep.
RewriteCond %{REQUEST_URI} (^|/)(assets|uploads|api)/ [NC]
RewriteRule ^ - [L]

# Block direct access to any other raw .php file except the front
# controllers (index.php, wherever it lives) and install.php (the wizard
# needs to run before config.php even exists, so it has to stay reachable
# until you remove it yourself). Matched by trailing filename only — this
# is what makes it work correctly inside a subfolder install too, instead
# of requiring the site to sit exactly at the domain root.
RewriteCond %{REQUEST_URI} !(^|/)index\.php$
RewriteCond %{REQUEST_URI} !(^|/)install\.php$
RewriteCond %{REQUEST_URI} \.php$ [NC]
RewriteRule ^ - [F,L]

# Everything else (front-end slugs: /, /wiki/<slug>, /register, /verify,
# /login, /api/...). A bare "/admin/" (or your renamed admin folder) is
# left to Apache's own DirectoryIndex, which resolves it to that folder's
# index.php automatically — no folder-name-specific rule needed here.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]

# Sensible security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Basic caching for speed
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType image/* "access plus 1 month"
</IfModule>
