# ============================================
# KnowledgeGathering - Apache-config
# ============================================

Options -Indexes

<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    # Camera toestaan (foto's maken op telefoon).
    Header always set Permissions-Policy "camera=(self), microphone=(), geolocation=()"
    # CSP: blob:/data: nodig voor foto-previews; alles blijft same-origin.
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'"
    Header unset X-Powered-By

    # App-shell en code nooit uit cache serveren — voorkomt dat een oude versie
    # van de app blijft hangen.
    <FilesMatch "\.(php|js|css)$">
        Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
        Header set Pragma "no-cache"
    </FilesMatch>
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Runtime-data nooit direct benaderbaar (verzamelde kennis + uploads).
    RewriteRule ^data(/|$) - [R=404,L]

    # .env, .git en .htaccess blokkeren.
    RewriteRule (^|/)\.env - [R=404,L]
    RewriteRule (^|/)\.git - [R=404,L]
    RewriteRule (^|/)\.htaccess$ - [R=404,L]
</IfModule>
