# OMLA site — DreamHost Apache config
# Serves static pages with hardened headers for XSS/clickjacking defense.

# ---------- Directory hardening ----------
# Never expose a browsable file listing (autoindex leaks the file inventory).
Options -Indexes

# ---------- Compression ----------
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json image/svg+xml
</IfModule>

# ---------- Caching ----------
<IfModule mod_headers.c>
  # First-party JS/CSS URLs carry cache-busting version params, but keep their
  # TTL short and never mark them immutable so emergency security changes still
  # reach returning visitors promptly. Vendored libs version their filename.
  <FilesMatch "\.(css|js)$">
    Header set Cache-Control "public, max-age=3600"
  </FilesMatch>
  <FilesMatch "\.(svg|png|jpg|gif|ico|webp)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
  <FilesMatch "\.(html|xml|json)$">
    Header set Cache-Control "public, max-age=300, must-revalidate"
  </FilesMatch>
</IfModule>

# ---------- Security headers ----------
<IfModule mod_headers.c>
  # Content-Security-Policy: scripts are first-party only (all libs vendored under
  # /assets/vendor/ — no runtime CDN, no inline scripts, no inline handlers).
  # Supabase stays in connect-src only; nothing is ever script-sourced from it.
  # JapanTrip/ overrides this header with its own .htaccess.
  Header always set Content-Security-Policy "default-src 'self'; \
    script-src 'self'; \
    style-src 'self' 'unsafe-inline'; \
    img-src 'self' data: https:; \
    font-src 'self' data:; \
    connect-src 'self'; \
    object-src 'none'; \
    frame-src 'none'; \
    frame-ancestors 'none'; \
    base-uri 'none'; \
    form-action 'self';"
  Header always set X-Frame-Options "DENY"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# ---------- Block internal/source files from public access ----------
# Schema/migration SQL, server source, systemd units, and internal docs must
# never be web-readable (defense-in-depth; also excluded from the deploy manifest).
<FilesMatch "\.(sql|py|service|md|sh|toml|ini|bak|log|yml|yaml)$">
  Require all denied
</FilesMatch>
<Files "system_prompt.txt">
  Require all denied
</Files>

# Stale example payloads from a retired API design (no-custody contradiction) —
# neutralized here and removed from the source tree.
RedirectMatch 404 ^/api/examples/

# ---------- Retired pages from the pre-pivot site (v1 pivot, 2026-07-19) ----------
# The v1 pivot cut the site to 11 pages. These pre-pivot URLs are permanently
# gone: 410 clears search indexes fastest and fires even while a stale file is
# still present on the host (RedirectMatch runs before file serving). The stale
# files themselves are removed server-side at cutover; rsync never uses --delete.
# NOTE: `commercial` is deliberately ABSENT from this list — /commercial.html is
# a LIVE page again (the commercial-user guide, settlement calculator and manifest
# verifier). The retired pre-pivot pages commercial-history and commercial-report
# stay gone. Re-adding a bare `commercial` here would 410 a live page.
RedirectMatch 410 ^/(acceptable-use|board|commercial-history|commercial-report|complaint|compliance|cookies|creators|dashboard|dashboard-earnings|dashboard-models|dashboard-wallets|for-platforms|hosters|legal|license-v1\.1|license-v1\.2|login|model|overview|partners|press|register|roadmap|support|users)(\.html)?$
RedirectMatch 410 ^/data(/.*)?$

# ---------- Pretty URLs / fallback ----------
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS + canonical apex host (301), one hop. The two conditions on the
  # HTTPS rule avoid a redirect loop behind DreamHost's TLS proxy: only redirect
  # when the request is NEITHER https (%{HTTPS}) NOR forwarded as https.
  RewriteCond %{HTTPS} off
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteRule ^ https://omla-ai.org%{REQUEST_URI} [R=301,L]
  RewriteCond %{HTTP_HOST} ^www\.omla-ai\.org$ [NC]
  RewriteRule ^ https://omla-ai.org%{REQUEST_URI} [R=301,L]

  # Redirect trailing slash on directories only.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_URI} !\.[a-zA-Z0-9]+$
  RewriteCond %{REQUEST_FILENAME}.html -f
  RewriteRule ^(.+)$ $1.html [L]
</IfModule>

# ---------- Disable server signature ----------
ServerSignature Off
