# ===========================================================================
# BLESSING SEFAH CURTAINS & BLINDS DECO — Apache configuration
# ---------------------------------------------------------------------------
# For Apache hosting (most shared cPanel hosts in Ghana). If you deploy to
# Nginx, Netlify, Vercel or Cloudflare Pages, translate the equivalent rules
# into that platform's configuration — see README.md.
#
# BEFORE GOING LIVE:
#   1. Confirm an SSL certificate is installed, then enable the HTTPS block.
#   2. Choose ONE canonical host (with or without www) and enable that block.
#   3. Test every redirect. A redirect loop takes the whole site offline.
# ===========================================================================

# ---------------------------------------------------------------------------
# 1. Default documents and directory listing
# ---------------------------------------------------------------------------
DirectoryIndex index.html
Options -Indexes -MultiViews

# ---------------------------------------------------------------------------
# 2. Custom error documents
# ---------------------------------------------------------------------------
ErrorDocument 404 /404.html
ErrorDocument 403 /404.html

# ---------------------------------------------------------------------------
# 3. Character set
# ---------------------------------------------------------------------------
AddDefaultCharset UTF-8
<IfModule mod_mime.c>
  AddType text/html .html
  AddType application/manifest+json .webmanifest
  AddType image/svg+xml .svg
  AddType image/webp .webp
  AddType image/avif .avif
  AddType font/woff2 .woff2
</IfModule>

# ---------------------------------------------------------------------------
# 4. Canonical URLs
# ---------------------------------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On

  # --- 4a. Force HTTPS -----------------------------------------------------
  # ENABLE ONCE AN SSL CERTIFICATE IS ACTIVE:
  # RewriteCond %{HTTPS} !=on
  # RewriteCond %{HTTP:X-Forwarded-Proto} !https
  # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

  # --- 4b. One canonical host ---------------------------------------------
  # Pick ONE of the two blocks below and replace the placeholder domain.
  #
  # Force www:
  # RewriteCond %{HTTP_HOST} !^www\. [NC]
  # RewriteCond %{HTTP_HOST} !^localhost [NC]
  # RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
  #
  # Force non-www:
  # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  # RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

  # --- 4c. Strip index.html from the root, to avoid duplicate content -----
  RewriteCond %{THE_REQUEST} \s/+index\.html[\s?] [NC]
  RewriteRule ^index\.html$ / [R=301,L]

  # --- 4d. Remove trailing slashes from file URLs -------------------------
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^(.+)/$ /$1 [R=301,L]

  # --- 4e. Optional: serve clean, extensionless URLs ----------------------
  # If you enable this, ALSO update every internal link, the canonical tags
  # and sitemap.xml to the extensionless form. Enabling it without doing so
  # creates two working URLs for every page.
  #
  # RewriteCond %{REQUEST_FILENAME} !-d
  # RewriteCond %{REQUEST_FILENAME}\.html -f
  # RewriteRule ^(.+)$ $1.html [L]
  #
  # RewriteCond %{THE_REQUEST} \s/+(.+)\.html[\s?] [NC]
  # RewriteRule ^ /%1 [R=301,L]

  # --- 4f. Block access to build tooling ----------------------------------
  RewriteRule ^tools/ - [F,L]
  RewriteRule ^README\.md$ - [F,L]

  # --- 4g. 301 redirect map for a site migration --------------------------
  # If this website replaces an older one, map each old URL to its closest
  # new equivalent here. One line per URL. Never redirect everything to the
  # homepage — that is treated as a soft 404.
  #
  # Redirect 301 /old-curtains-page.php /curtains.html
  # Redirect 301 /shop/blinds /blinds.html
  # Redirect 301 /contact-us /contact.html
</IfModule>

# ---------------------------------------------------------------------------
# 5. Compression
# ---------------------------------------------------------------------------
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
  AddOutputFilterByType DEFLATE application/javascript application/x-javascript
  AddOutputFilterByType DEFLATE application/json application/xml
  AddOutputFilterByType DEFLATE application/manifest+json
  AddOutputFilterByType DEFLATE image/svg+xml
  AddOutputFilterByType DEFLATE font/woff2
</IfModule>

<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/css text/xml
  AddOutputFilterByType BROTLI_COMPRESS application/javascript application/json
  AddOutputFilterByType BROTLI_COMPRESS image/svg+xml
</IfModule>

# ---------------------------------------------------------------------------
# 6. Browser caching
# HTML is kept short so content edits appear immediately. Static assets are
# cached hard — add a ?v=2 query string to style.css / main.js when you
# change them so browsers pick the new file up.
# ---------------------------------------------------------------------------
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault                              "access plus 1 month"

  ExpiresByType text/html                     "access plus 0 seconds"
  ExpiresByType application/xml               "access plus 0 seconds"
  ExpiresByType text/xml                      "access plus 0 seconds"

  ExpiresByType text/css                      "access plus 1 year"
  ExpiresByType application/javascript        "access plus 1 year"

  ExpiresByType image/svg+xml                 "access plus 1 year"
  ExpiresByType image/jpeg                    "access plus 1 year"
  ExpiresByType image/png                     "access plus 1 year"
  ExpiresByType image/webp                    "access plus 1 year"
  ExpiresByType image/avif                    "access plus 1 year"
  ExpiresByType image/x-icon                  "access plus 1 year"

  ExpiresByType font/woff2                    "access plus 1 year"
  ExpiresByType application/manifest+json     "access plus 1 week"
</IfModule>

<IfModule mod_headers.c>
  <FilesMatch "\.(css|js|svg|jpe?g|png|webp|avif|woff2)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
  <FilesMatch "\.html$">
    Header set Cache-Control "public, max-age=0, must-revalidate"
  </FilesMatch>
</IfModule>

# ---------------------------------------------------------------------------
# 7. Security headers
# NOTE: the CSP below allows exactly the third parties this site uses today
# (Google Fonts, jsDelivr for Bootstrap, and Google Maps for the contact
# embed). Add a source before adding a new script, or the browser blocks it.
# ---------------------------------------------------------------------------
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"

  # Enable only after HTTPS is confirmed working on every subdomain.
  # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

  Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' https://fonts.googleapis.com https://cdn.jsdelivr.net 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net; img-src 'self' data:; connect-src 'self'; frame-src https://www.google.com https://maps.google.com; form-action 'self'; upgrade-insecure-requests"

  # Do not leak the server signature
  Header unset X-Powered-By
  Header unset Server
</IfModule>

ServerSignature Off

# ---------------------------------------------------------------------------
# 8. Protect sensitive files
# ---------------------------------------------------------------------------
<FilesMatch "^\.(htaccess|htpasswd|env|git.*)$">
  Require all denied
</FilesMatch>

<FilesMatch "\.(md|ps1|log|bak|sql|ini|yml|yaml)$">
  Require all denied
</FilesMatch>
