# Quartermaster Foundation - Apache Configuration
# This file provides security settings and clean URLs

# ===========================================
# SECURITY SETTINGS
# ===========================================

# Prevent directory browsing
Options -Indexes

# Protect sensitive files
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

# Protect includes folder
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^includes/ - [F,L]
</IfModule>

# Dynamic CMS page routing
# Routes /pages/{slug} to page.php?slug={slug}
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^pages/([a-z0-9][a-z0-9-]*)/?$ /page.php?slug=$1 [L,QSA]
</IfModule>

# Prevent access to config files
<FilesMatch "(config\.php|\.htaccess|\.htpasswd)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# ===========================================
# CLEAN URLs (Optional)
# ===========================================
# Uncomment the lines below to enable clean URLs
# (e.g., /about instead of /about.php)

# <IfModule mod_rewrite.c>
#     RewriteEngine On
#     RewriteBase /
#
#     # Remove .php extension
#     RewriteCond %{REQUEST_FILENAME} !-d
#     RewriteCond %{REQUEST_FILENAME}\.php -f
#     RewriteRule ^(.*)$ $1.php [L]
# </IfModule>

# ===========================================
# PERFORMANCE
# ===========================================

# Enable compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json
</IfModule>

# Browser caching for static assets
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/gif "access plus 1 month"
    ExpiresByType text/css "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"
</IfModule>

# ===========================================
# ERROR PAGES (Optional)
# ===========================================
# Uncomment to use custom error pages

ErrorDocument 404 /404.php
# ErrorDocument 500 /500.php

# ===========================================
# FORCE HTTPS (Uncomment for production)
# ===========================================
# <IfModule mod_rewrite.c>
#     RewriteEngine On
#     RewriteCond %{HTTPS} off
#     RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# </IfModule>
