# HostBMS — Apache / LiteSpeed rules. The router.php dev router mirrors these.
Options -Indexes

# Fallback when mod_rewrite is unavailable: never serve templates, docs or config-like files.
<FilesMatch "\.(tpl|md|neon|lock|sql|sh)$|^(configuration(\.sample)?\.php|init\.php|router\.php|composer\.json|phpunit\.xml(\.dist)?)$">
    Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Rules use [F] (403) and plain RewriteRule lines only, because OpenLiteSpeed reads rewrite
    # rules from .htaccess but ignores FilesMatch/Require blocks.

    # Code, data and tooling folders are not web content, except the external API.
    RewriteRule ^includes/api\.php$ - [L]
    RewriteRule ^(src|vendor|includes|crons|templates|templates_c|docs|bin|database|tests|attachments|downloads)(/|$) - [F,L]

    # Templates, docs and config-like files anywhere (same list as the FilesMatch block above).
    RewriteRule \.(tpl|md|neon|lock|sql|sh|log|dist)$ - [F,L]
    RewriteRule (^|/)(configuration(\.sample)?\.php|init\.php|router\.php|composer\.json|phpunit\.xml)$ - [F,L]

    # The installer switches itself off once installed; this also hides it (install at the web root).
    RewriteCond %{DOCUMENT_ROOT}/install.lock -f
    RewriteRule ^install(/|$) - [F,L]

    # Dotfiles (.git, .env), except ACME challenges.
    RewriteCond %{REQUEST_URI} !/\.well-known/
    RewriteRule (^|/)\. - [F,L]
</IfModule>
