# Drop into the api.genesiscoworkingspace.com.my docroot / application root.
# Passenger routes real API requests before Apache would serve a file; this is
# defence in depth for the case where a path slips through.

Options -Indexes

# Deny direct access to everything that isn't meant to be fetched over HTTP.
RedirectMatch 404 (?i)/\.(?!well-known)          # dotfiles (.env, .git, ...)
RedirectMatch 404 (?i)/(src|migrations|seeds|logs|storage|node_modules|scripts|test)(/|$)
RedirectMatch 404 (?i)/(package(-lock)?\.json|tsconfig\.json|knexfile\.ts|vitest\.config\.ts)$
RedirectMatch 404 (?i)/dist/(?!server\.js$).*\.map$   # source maps

# HSTS — the subdomain is HTTPS-only (AutoSSL).
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>