# ---------------------------------------------------------------------------
# The whole application lives in this folder, but only public/ may be served.
# ---------------------------------------------------------------------------
# Every request is rewritten into public/, where Laravel's own .htaccess takes
# over. The (?!public/) guard is what stops the rewrite applying a second time
# to its own output and looping.
#
# The deny rules below are the backstop: if mod_rewrite were ever switched off
# for this account, the rewrite would stop happening and .env, the database and
# the logs would otherwise be downloadable at their plain URLs.

Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(?!public/)(.*)$ public/$1 [L]
</IfModule>

<IfModule mod_authz_core.c>
    <FilesMatch "^(\.env.*|\.git.*|composer\.(json|lock)|artisan|.*\.sqlite|.*\.md|phpunit\.xml)$">
        Require all denied
    </FilesMatch>
</IfModule>
