# .htaccess: Apache rules of the application folder in the domain (the mirror of the php/ folder of the repository).
# The folder is opened by index.php; panel.html, VERSION, the licence files (LICENSE, LICENSE.pl.md), the maintenance file of an update (.knock-maintenance), every .json and .json.gz file and leftover temporary files are never served; every answer is noindex.
# The Content-Security-Policy below allows only the files of this folder and nothing inline (PHP sends the same policy itself, because .htaccess has no effect on nginx).
# A report-only policy set by a parent .htaccess is removed here, because this folder sets its own enforced one. Assets are cached for a year: they live in assets/<version>/, a folder named after a hash of their content, so a file never changes under its address.
# There is no Options directive on purpose: a host that allows overrides without Options would answer 500 for it.
# Blocks that depend on a module are wrapped in <IfModule>, so a server without that module still serves the folder.
# @comments-complete 2026-11-05

# Inherit the rules of the main .htaccess (HTTP to HTTPS, www redirect), which a rewrite section of a sub-folder would otherwise drop.
<IfModule mod_rewrite.c>
  RewriteOptions Inherit
</IfModule>

<IfModule mod_dir.c>
  DirectoryIndex index.php
</IfModule>

# Fails closed: without mod_authz_core (Apache 2.4) the server answers 500 instead of serving the files.
<FilesMatch "^(panel\.html|VERSION|LICENSE|LICENSE\.pl\.md|\.knock-maintenance)$|\.json(\.gz)?$|\.tmp-[0-9]+$">
  Require all denied
</FilesMatch>

# The Inter font files of the panel are served as font/woff2 even on a server whose type table does not know the extension yet.
<IfModule mod_mime.c>
  AddType font/woff2 .woff2
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Robots-Tag "noindex, nofollow"
  Header always unset Content-Security-Policy-Report-Only
  Header always set Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
  <FilesMatch "\.(css|js|svg|woff2)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
</IfModule>
