# CRMR (standalone)
#
# Recommended: point your domain or subdomain's document root at the public/ folder.
# This file is the fallback for hosting where you cannot change the document root:
# it sends every request into public/ and blocks the application, vendor, and data folders.

Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Block internal folders and dotfiles outright.
  RewriteRule ^(app|data|vendor|docs|tests|shared)(/|$) - [F,L]
  RewriteRule (^|/)\. - [F,L]
  # Requests already inside public/ are handled by public/.htaccess. (Matched at the start of the
  # path: a URL that merely contains /public/, such as /api/public/..., still goes to public/.)
  RewriteRule ^public/ - [L]
  # Everything else is served from public/.
  RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

<FilesMatch "\.(sqlite|sqlite3|db|log|lock|txt|md)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>
