ServerName localhost
ServerTokens Prod
ServerSignature Off
TraceEnable Off

# Only expose this HTTP listener to a trusted reverse proxy. The proxy must
# overwrite X-Forwarded-Proto, not pass a client-supplied value through.
# PHP uses HTTPS to decide whether participant/admin cookies need Secure.
SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on

<Directory /var/www/html>
    Options -Indexes -MultiViews
    AllowOverride None
    DirectoryIndex index.php
    Require all granted
</Directory>

# Internal code is still usable by PHP/CLI, never directly over HTTP.
<DirectoryMatch "^/var/www/html/(?:includes|DB|dev|docker|dashboard/(?:tools|migrations))(?:/|$)">
    Require all denied
</DirectoryMatch>

# Also deny dotfiles and backup/config files if accidentally added later.
<LocationMatch "(?:^|/)\.">
    Require all denied
</LocationMatch>
<FilesMatch "(?i)\.(?:sql(?:\.gz|\.zip)?|ini|env|toml|ya?ml|log|bak)$">
    Require all denied
</FilesMatch>

Alias /healthz /usr/local/share/recruitment/health.php
<Directory /usr/local/share/recruitment>
    Options -Indexes
    AllowOverride None
    Require all denied
    <Files health.php>
        Require all granted
    </Files>
</Directory>

Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "same-origin"