# Invoice System — XAMPP-level protection (Apache 2.4).
# Under Docker these rules are inert: Apache's docroot is /public there,
# so nothing outside /public is even reachable by URL.

# Never serve env files, docs, logs, SQL dumps, or config files.
<FilesMatch "(^\.env|\.sql$|\.log$|\.md$|\.yml$|\.example$)">
    Require all denied
</FilesMatch>

# Hide app internals, dependencies, logs, and repo metadata as 404s.
RedirectMatch 404 (^|/)(app|vendor|logs)(/|$)
RedirectMatch 404 (^|/)\.git

# Bare project URL (/) falls through to the public front controller.
# Only fires on the empty path — safe, no loop, other URLs untouched.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^$ public/ [L]
</IfModule>
