Options -Indexes -MultiViews
ServerSignature Off
DirectoryIndex index.php index.html

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Mantem o Authorization header para ambientes que usam API/autenticacao.
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Nao reescreve se o destino ja for a pagina de erro.
    RewriteRule ^pages/404\.php$ - [L]

    # Se nao existir arquivo/pasta fisico:
    # 1) usa pages/404.php (quando existir)
    # 2) caso contrario, cai para index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{DOCUMENT_ROOT}/pages/404.php -f
    RewriteRule ^ pages/404.php [L]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L]
</IfModule>

# 404 nativo do Apache tambem usa a pagina personalizada.
ErrorDocument 404 /pages/404.php

<IfModule mod_headers.c>
    # Basico de seguranca sem quebrar conteudo estatico.
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

    # Ajuste HSTS somente em HTTPS de producao (evita problemas no localhost).
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" "expr=%{HTTPS} == 'on'"
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On

    # HTML: revalidacao frequente.
    ExpiresByType text/html "access plus 5 minutes"

    # CSS/JS: cache intermediario.
    ExpiresByType text/css "access plus 30 days"
    ExpiresByType application/javascript "access plus 30 days"
    ExpiresByType text/javascript "access plus 30 days"

    # Imagens e fontes: cache mais longo.
    ExpiresByType image/jpeg "access plus 6 months"
    ExpiresByType image/png "access plus 6 months"
    ExpiresByType image/gif "access plus 6 months"
    ExpiresByType image/webp "access plus 6 months"
    ExpiresByType image/svg+xml "access plus 6 months"
    ExpiresByType image/x-icon "access plus 6 months"
    ExpiresByType font/woff2 "access plus 6 months"
    ExpiresByType font/woff "access plus 6 months"
</IfModule>

<IfModule mod_deflate.c>
    # Compressao de texto para reduzir trafego.
    AddOutputFilterByType DEFLATE text/plain text/html text/css
    AddOutputFilterByType DEFLATE application/javascript application/json application/xml
    AddOutputFilterByType DEFLATE text/javascript text/xml image/svg+xml
</IfModule>

# Nao faz cache de arquivos sensiveis.
<FilesMatch "(^\.|composer\.(json|lock)|package(-lock)?\.json|yarn\.lock|\.env)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Evita acesso direto ao arquivo de configuracao nao publicado.
<Files "htaccess.txt">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>
