# Front controller. Document root must be this directory; app/, keys/, storage/, vendor/ stay outside it.
Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Never serve dotfiles or PHP other than the front controller
    RewriteRule (^|/)\. - [F]
    # install.php is the one-time setup wizard; it switches itself off once the system is installed
    RewriteCond %{REQUEST_URI} !(^|/)install\.php$
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule \.php$ - [F,L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

<FilesMatch "^(index|install)\.php$">
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    # The service worker must always be revalidated so an update reaches every device quickly.
    <FilesMatch "^sw\.js$">
        Header set Cache-Control "no-cache"
    </FilesMatch>
</IfModule>
