# TacmicCMS 2.0 Root Security & Protection Rules

# 1. Block direct web access to sensitive config & dot files
<FilesMatch "^(config\.php|mainfile\.php|\.env.*|\.git.*|\.htaccess)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# 2. Block direct web access to internal caches inside public/ (templates_c & cache)
# Note: uploads/ remains publicly accessible for images/media
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Backward Compatibility (1.1 -> 2.0): Seamlessly serve legacy /uploads/ and /modules/
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^uploads/(.*)$ public/uploads/$1 [L,QSA]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^modules/(.*)$ m/$1 [L,QSA]

    # Block direct web access to internal caches inside public/ (templates_c & cache)
    RewriteRule ^public/(cache|templates_c)/ - [F,L]
</IfModule>

# 3. Disable directory browsing
Options -Indexes
