# dns-manager/.htaccess

Options -Indexes
php_flag display_errors off
php_flag expose_php off
php_value open_basedir "/var/www/html:/tmp"
php_flag allow_url_fopen off

# ── Verzeichnisse sperren ─────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Direktzugriff auf interne Verzeichnisse verbieten
    RewriteRule ^config/   - [F,L]
    RewriteRule ^core/     - [F,L]
    RewriteRule ^cron/     - [F,L]
    RewriteRule ^setup/    - [F,L]
    RewriteRule ^templates/ - [F,L]

    # setup.php nach Ersteinrichtung gesperrt
    RewriteRule ^setup\.php - [F,L]
</IfModule>

# ── Security-Header ───────────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "same-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always unset X-Powered-By
    Header always unset Server

    # Content Security Policy – anpassen wenn weitere externe Ressourcen nötig
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self';"
</IfModule>

# ── Caching für statische Assets ─────────────────────────────
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css             "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
    ExpiresByType image/png            "access plus 30 days"
    ExpiresByType image/svg+xml        "access plus 30 days"
</IfModule>
