# /home/onairada/public_html/.htaccess
#
# The project root lives in this web-served directory, so these deny rules
# are load-bearing, not belt-and-braces: without them the application's
# .env is a downloadable URL. Keep them ABOVE the proxy rules — a [P]
# rule is terminal (L) and would forward the request before we ever
# reach a rule placed below it.

# --- 1. Deny access to source, config and VCS ---------------------------
# Matched against the request path, so /apps/api/.env is covered as well
# as /.env, which is the gap ModSecurity's generic /.env rule leaves open.
RedirectMatch 404 (?i)/\.env
RedirectMatch 404 (?i)/\.git
RedirectMatch 404 (?i)/node_modules
RedirectMatch 404 (?i)/packages/
RedirectMatch 404 (?i)/apps/
RedirectMatch 404 (?i)/docs/
RedirectMatch 404 (?i)/deploy/
RedirectMatch 404 (?i)/package(-lock)?\.json
RedirectMatch 404 (?i)/ecosystem\.config\.js
RedirectMatch 404 (?i)/\.(editorconfig|gitignore|gitattributes)$

# Belt and braces: even if a rule above is edited away, refuse dotfiles.
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# --- 2. Proxy everything else to the Node processes ---------------------
RewriteEngine On

RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule ^(.*)$ ws://127.0.0.1:3000/$1 [P,L]

# API first — the more specific prefix.
RewriteRule ^api/(.*)$ http://127.0.0.1:4000/api/$1 [P,L,QSA]

# Everything else is the Next.js site.
RewriteRule ^(.*)$ http://127.0.0.1:3000/$1 [P,L,QSA]

ProxyPreserveHost On

# Cloudflare terminates TLS, so the origin often sees plain HTTP. Trust
# CF's own header rather than deriving the scheme from Apache's HTTPS
# variable, which would tell the app the wrong thing and can loop a
# redirect. Guarded: without mod_headers the directive is a 500, not a
# skipped line.
<IfModule mod_headers.c>
  RequestHeader set X-Forwarded-Proto "https" env=HTTP_CF_VISITOR
</IfModule>