# =====================================================================
# Ravan Mailer - Apache / cPanel security hardening
# Place this file in your web root (e.g. public_html/ or the app's
# root folder such as public_html/bulkmailer/).
# =====================================================================

# ---------------------------------------------------------------------
# 1) Disable directory listing ("Index of /" pages)
# ---------------------------------------------------------------------
Options -Indexes
IndexIgnore *

# ---------------------------------------------------------------------
# 2) Block direct access to sensitive files/folders
#    (env files, git metadata, python source, configs, logs, DB dumps)
# ---------------------------------------------------------------------
<FilesMatch "(^\.env.*|\.git.*|\.py$|\.pyc$|\.ini$|\.cfg$|\.log$|\.sql$|\.sqlite3?$|\.bak$|\.zip$|\.tar$|\.tar\.gz$|requirements\.txt|docker-compose\.ya?ml|Dockerfile|\.dockerignore|package(-lock)?\.json)">
    Require all denied
</FilesMatch>

# Deny access to hidden files/folders (.git, .env, .ssh, etc.)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Block common sensitive directories entirely
RedirectMatch 403 ^/(\.git|\.env|node_modules|scripts|alembic|migrations|tests|app|uploads/.*\.py)/?

# ---------------------------------------------------------------------
# 3) Prevent execution of scripts inside the uploads directory
#    (defense-in-depth: stops uploaded files from ever being executed)
# ---------------------------------------------------------------------
<IfModule mod_php.c>
    <Directory "uploads">
        php_flag engine off
    </Directory>
</IfModule>
<FilesMatch "\.(php|php\d|phtml|pl|py|cgi|sh)$">
    <If "%{REQUEST_URI} =~ m#^/uploads/#">
        Require all denied
    </If>
</FilesMatch>

# ---------------------------------------------------------------------
# 4) Security headers
# ---------------------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ---------------------------------------------------------------------
# 5) Custom error page for blocked/forbidden access (optional, avoids
#    leaking Apache version/server info on 403 pages)
# ---------------------------------------------------------------------
ErrorDocument 403 "Access Denied"
ErrorDocument 404 "Not Found"

# ---------------------------------------------------------------------
# 6) If Node.js/Passenger is proxying this app, ensure static assets
#    still resolve correctly (adjust only if using cPanel Passenger)
# ---------------------------------------------------------------------
# PassengerAppRoot "/home/USERNAME/bulkmailer"
# PassengerBaseURI "/"
