# ======================================================================
# osTicket - Apache / LiteSpeed .htaccess (osTicket application root)
# ======================================================================
# Place this file in the osTicket application directory (e.g. /support/).
# Do NOT overwrite the .htaccess files shipped inside api/, kb/, etc.
# If an application-root .htaccess already exists, back it up and MERGE
# these settings after checking for conflicts; do not blindly replace it.
# Requires Apache/LiteSpeed with the relevant overrides enabled.
# ======================================================================

# Do not expose directory contents when an index file is absent.
Options -Indexes

# Default osTicket entry point.
DirectoryIndex index.php

# ----------------------------------------------------------------------
# Protect configuration, backup and development files from direct access.
# This does not change osTicket PHP routing or its API rewrite rules.
# ----------------------------------------------------------------------
<FilesMatch "(?i)^(?:\.env(?:\..*)?|\.user\.ini|\.gitignore|\.gitattributes|ost-config\.php|composer\.(?:json|lock)|phpunit\.xml(?:\.dist)?)$">
    Require all denied
</FilesMatch>

<FilesMatch "(?i)\.(?:bak|backup|log|old|orig|sql|sqlite|swp|tmp|ya?ml)$">
    Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Prevent requests into accidentally uploaded VCS metadata folders.
    RewriteRule (^|/)\.(git|svn|hg)(/|$) - [F,L,NC]

    # OPTIONAL: Enable ONLY after valid HTTPS is configured.
    # If behind a trusted HTTPS reverse proxy, adjust at the proxy/server.
    # RewriteCond %{HTTPS} !=on
    # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,NE]

    # IMPORTANT: No catch-all rewrites here.
    # osTicket's own subdirectory .htaccess files handle required API,
    # knowledgebase and other application-specific routes.
</IfModule>

# ----------------------------------------------------------------------
# Browser security headers (no CSP or iframe blocking by default, since
# these may conflict with integrations and embedded help desks).
# ----------------------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # OPTIONAL clickjacking protection if osTicket is NOT embedded on a
    # different origin. Uncomment only after verifying your integration.
    # Header always set X-Frame-Options "SAMEORIGIN"

    # OPTIONAL: Use HSTS only after HTTPS works across your domain.
    # Header always set Strict-Transport-Security "max-age=31536000"
</IfModule>

# ----------------------------------------------------------------------
# Compress text responses (PHP-generated HTML, CSS, JS, JSON and XML).
# ----------------------------------------------------------------------
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css
    AddOutputFilterByType DEFLATE text/javascript application/javascript
    AddOutputFilterByType DEFLATE application/json application/xml text/xml
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# ----------------------------------------------------------------------
# Cache static resources only. Dynamic ticket pages retain osTicket's
# application-controlled cache behavior.
# ----------------------------------------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 1 day"
    ExpiresByType text/javascript "access plus 1 day"
    ExpiresByType application/javascript "access plus 1 day"
    ExpiresByType image/png "access plus 7 days"
    ExpiresByType image/jpeg "access plus 7 days"
    ExpiresByType image/gif "access plus 7 days"
    ExpiresByType image/webp "access plus 7 days"
    ExpiresByType image/avif "access plus 7 days"
    ExpiresByType image/svg+xml "access plus 7 days"
    ExpiresByType image/x-icon "access plus 7 days"
    ExpiresByType font/woff "access plus 7 days"
    ExpiresByType font/woff2 "access plus 7 days"
</IfModule>

# After osTicket installation is complete, DELETE the /setup/ directory
# and remove write access to include/ost-config.php, per official guidance.

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit