.htaccess

RewriteEngine On

# Block access to sensitive files at root level
<FilesMatch "^(\.env|\.env\..+|\.git.*|\.installed|composer\.(json|lock)|package(-lock)?\.json|CLAUDE\.md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# Prevent directory browsing
Options -Indexes

# Exclude installer and scripts from rewrite (allow direct access)
RewriteCond %{REQUEST_URI} (^|/)installer(/|$) [NC,OR]
RewriteCond %{REQUEST_URI} (^|/)scripts/manual-upgrade\.php$ [NC]
RewriteRule ^ - [L]

# Allow direct access to calendar files (.ics) for subscription URLs
RewriteCond %{REQUEST_URI} ^/storage/calendar/.*\.ics$ [NC]
RewriteRule ^ - [L]

# Redirect everything else to /public/
RewriteCond %{REQUEST_URI} !^/public/
RewriteRule ^(.*)$ public/$1 [L,QSA]