# EtongaERP — Apache (1dollar-webhosting, cPanel, OVH, Hostinger…)
AddDefaultCharset UTF-8
AddCharset UTF-8 .html .js .css .json

# Type JS correct (certains hôtes servent .js en text/plain)
AddType application/javascript .js
AddType text/css .css
AddType image/svg+xml .svg
AddType image/png .png

# Fichier d'accueil : index.php route vers install/login/app
DirectoryIndex index.php index.html

# Compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

# Cache des assets statiques
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/png "access plus 30 days"
  ExpiresByType image/svg+xml "access plus 30 days"
  ExpiresByType text/html "access plus 0 seconds"
</IfModule>

# En-têtes de sécurité
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "DENY"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# PROTECTION : interdire l'accès direct aux fichiers sensibles
<FilesMatch "(^config\.php$|\.lock$|\.sql$|^db\.php$)">
  Require all denied
</FilesMatch>

# Dossiers internes (sauvegardes de MAJ, temp) — jamais accessibles via le web
RedirectMatch 404 ^/.*/_backups/
RedirectMatch 404 ^/.*/_tmp_update/
RedirectMatch 404 ^/_backups/
RedirectMatch 404 ^/_tmp_update/

# Bloquer les fichiers cachés (.htaccess, .git…)
<FilesMatch "^\.(?!well-known)">
  Require all denied
</FilesMatch>

# Forcer HTTPS — décommentez quand votre SSL est actif
# RewriteEngine On
# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
