# CareIPC — Apache / cPanel
Options -Indexes
DirectoryIndex index.php
RewriteEngine On

# Force HTTPS (uncomment in production)
# RewriteCond %{HTTPS} !=on
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Private folders are never served
RewriteRule ^(lib|config|sql|setup|bin|tests|storage|docs)(/|$) - [F,L]
RewriteRule (^|/)\. - [F,L]
RewriteRule ^router\.php$ - [F,L]
RewriteRule (^|/)_[^/]*\.php$ - [F,L]

# Inbound API (pass the Authorization header through to PHP)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteRule ^api/v1/([a-z]+)/?$ api/index.php?r=$1 [L,QSA]

# SEO files
RewriteRule ^health$ web/health.php [L]
RewriteRule ^sitemap\.xml$ web/sitemap.php [L]
RewriteRule ^robots\.txt$ web/robots.php [L]
RewriteRule ^llms\.txt$ web/llms.php [L]

# Clean marketing URLs: /hai-surveillance-software -> web/page.php?slug=...
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([a-z0-9-]+)/?$ web/page.php?slug=$1 [L,QSA]

ErrorDocument 404 /web/page.php?slug=__404

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 30 days"
  ExpiresByType application/javascript "access plus 30 days"
  ExpiresByType image/svg+xml "access plus 30 days"
</IfModule>
