# MEDRA — site root
Options -Indexes
DirectoryIndex index.html

# Uncomment to force HTTPS (location, install and login all require it):
# <IfModule mod_rewrite.c>
# RewriteEngine On
# RewriteCond %{HTTPS} !=on
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# </IfModule>

# Private application files
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^private(/|$) - [F,L]
RewriteRule ^medra-paths\.php$ - [F,L]
</IfModule>

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "no-referrer"
Header always set X-Frame-Options "DENY"
Header always set Permissions-Policy "geolocation=(self), camera=(), microphone=()"
# The service worker and the runtime config must never be served stale
<FilesMatch "^(sw\.js|config\.js|index\.html)$">
Header set Cache-Control "no-cache"
</FilesMatch>
</IfModule>

<IfModule mod_mime.c>
AddType application/manifest+json .webmanifest
</IfModule>
