Options -Indexes
DirectoryIndex index.php index.html

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Public landing page dan referral ejen
  RewriteRule ^r/([A-Za-z0-9_-]+)/?$ public.php?ref=$1 [L,QSA]
  RewriteRule ^r/([A-Za-z0-9_-]+)/project/([A-Za-z0-9_-]+)/?$ public.php?ref=$1&project=$2 [L,QSA]
  RewriteRule ^project/([A-Za-z0-9_-]+)/?$ public.php?project=$1 [L,QSA]
  RewriteRule ^projek/([A-Za-z0-9_-]+)/?$ public.php?project=$1 [L,QSA]

  # Block direct access to internal folders
  RewriteRule ^(app|config|database|storage)/ - [F,L]
</IfModule>

<FilesMatch "^(\.env|composer\.(json|lock)|README.*|.*\.sql|.*\.bak|.*\.log)$">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set X-Permitted-Cross-Domain-Policies "none"
  Header set Cache-Control "no-store, no-cache, must-revalidate" "expr=%{REQUEST_URI} =~ m#^/nexusproperty/(dashboard|modules|login|install)#"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json image/svg+xml
</IfModule>
