# =================================================================
# SeraNeon Salary Slip Portal - Apache config
# Tested on GoDaddy / cPanel shared hosting (Apache + mod_rewrite).
# =================================================================

# --- 1. Default file ---------------------------------------------
DirectoryIndex index.php

# --- 2. Block search engines (defense-in-depth alongside robots.txt)
<IfModule mod_headers.c>
    Header set X-Robots-Tag "noindex, nofollow, noarchive, nosnippet"
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "no-referrer"
    Header set Permissions-Policy "geolocation=(), camera=(), microphone=()"
</IfModule>

# --- 3. Disable directory listing --------------------------------
Options -Indexes -MultiViews

# --- 4. Block access to sensitive files & directories ------------
<FilesMatch "(^\.|composer\.(json|lock)|\.env|\.md|\.log|\.json)$">
    Require all denied
</FilesMatch>

# Deny config files individually for older Apache as well
<Files "config.php">
    Require all denied
</Files>

# --- 5. Block direct browser access to internal folders ----------
RedirectMatch 403 ^/seraneonsalary/(uploads|generated_pdfs|zips|history|lib|vendor|templates)/.*$
RedirectMatch 403 ^/(uploads|generated_pdfs|zips|history|lib|vendor|templates)/.*$

# --- 6. PHP runtime tweaks (best-effort, ignored on some hosts) --
<IfModule mod_php.c>
    php_flag display_errors Off
    php_value upload_max_filesize 6M
    php_value post_max_size 8M
    php_value memory_limit 256M
    php_value max_execution_time 120
</IfModule>
<IfModule mod_php7.c>
    php_flag display_errors Off
    php_value upload_max_filesize 6M
    php_value post_max_size 8M
    php_value memory_limit 256M
    php_value max_execution_time 120
</IfModule>
<IfModule mod_php8.c>
    php_flag display_errors Off
    php_value upload_max_filesize 6M
    php_value post_max_size 8M
    php_value memory_limit 256M
    php_value max_execution_time 120
</IfModule>
