# Yasnocore Voice perimeter hardening (root)
Options -Indexes

<IfModule mod_alias.c>
  RedirectMatch 403 ^/(?:storage|app|_backups|_updates)(?:/|$)
  RedirectMatch 403 ^/public_html/admin/storage(?:/|$)
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Allow ACME /.well-known/ challenges, block all other dot-files.
  RewriteRule "(^|/)\.(?!well-known(?:/|$))" - [F,L]

  # Block internal runtime and package directories.
  RewriteRule "^(?:storage|app|_backups|_updates)(?:/|$)" - [F,L,NC]
  RewriteRule "^public_html/admin/storage(?:/|$)" - [F,L,NC]

  # Block sensitive artifacts and helper scripts anywhere in the tree.
  RewriteRule "(^|/)(?:\.env(?:\..*)?|composer\.(?:json|lock)|package(?:-lock)?\.json|yarn\.lock|pnpm-lock\.yaml|phpunit\.xml(?:\.dist)?|manifest(?:_v[0-9]+)?\.json)$" - [F,L,NC]
  RewriteRule "(^|/).+\.(?:sql|zip|log|bak|old|dist|pid|lock|ini|env|pem|key|py|sh)$" - [F,L,NC]
</IfModule>

<IfModule mod_authz_core.c>
  <FilesMatch "(?i)^(?:\.env(?:\..*)?|composer\.(?:json|lock)|package(?:-lock)?\.json|yarn\.lock|pnpm-lock\.yaml|phpunit\.xml(?:\.dist)?|manifest(?:_v[0-9]+)?\.json)$">
    Require all denied
  </FilesMatch>
  <FilesMatch "(?i)\.(?:sql|zip|log|bak|old|dist|pid|lock|ini|env|pem|key|py|sh)$">
    Require all denied
  </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
  <FilesMatch "(?i)^(?:\.env(?:\..*)?|composer\.(?:json|lock)|package(?:-lock)?\.json|yarn\.lock|pnpm-lock\.yaml|phpunit\.xml(?:\.dist)?|manifest(?:_v[0-9]+)?\.json)$">
    Deny from all
  </FilesMatch>
  <FilesMatch "(?i)\.(?:sql|zip|log|bak|old|dist|pid|lock|ini|env|pem|key|py|sh)$">
    Deny from all
  </FilesMatch>
</IfModule>
