ServerName your-domain.com ServerAlias www.your-domain.com DocumentRoot /var/www/bikeservice/backend/public AllowOverride All Require all granted # Laravel specific rules RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ index.php [QSA,L] # Security headers Header always set X-Frame-Options "SAMEORIGIN" Header always set X-XSS-Protection "1; mode=block" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "no-referrer-when-downgrade" Header always set Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" # Gzip compression SetOutputFilter DEFLATE SetEnvIfNoCase Request_URI \ \.(?:gif|jpe?g|png)$ no-gzip dont-vary SetEnvIfNoCase Request_URI \ \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary SetEnvIfNoCase Request_URI \ \.(?:pdf|mov|avi|mp3|mp4|rm)$ no-gzip dont-vary # Cache static assets ExpiresActive On ExpiresDefault "access plus 1 year" Header append Cache-Control "public, immutable" Header append Vary Accept-Encoding # Cache API responses (no cache) Header set Cache-Control "no-cache, no-store, must-revalidate" Header set Pragma "no-cache" Header set Expires "0" # Deny access to sensitive files Require all denied # Deny access to hidden files Require all denied # Health check endpoint SetHandler server-status Require all granted # Logging ErrorLog ${APACHE_LOG_DIR}/bikeservice_error.log CustomLog ${APACHE_LOG_DIR}/bikeservice_access.log combined # Client max body size (for file uploads) LimitRequestBody 67108864 # Timeouts Timeout 300 KeepAliveTimeout 5 MaxKeepAliveRequests 100 # SSL Configuration (uncomment after obtaining SSL certificate) # # ServerName your-domain.com # ServerAlias www.your-domain.com # DocumentRoot /var/www/bikeservice/backend/public # # SSLEngine on # SSLCertificateFile /etc/letsencrypt/live/your-domain.com/fullchain.pem # SSLCertificateKeyFile /etc/letsencrypt/live/your-domain.com/privkey.pem # # # Include all the same configuration as above # # AllowOverride All # Require all granted # # RewriteEngine On # RewriteCond %{REQUEST_FILENAME} !-f # RewriteCond %{REQUEST_FILENAME} !-d # RewriteRule ^(.*)$ index.php [QSA,L] # # # # Security headers # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" # Header always set X-Frame-Options "SAMEORIGIN" # Header always set X-XSS-Protection "1; mode=block" # Header always set X-Content-Type-Options "nosniff" # Header always set Referrer-Policy "no-referrer-when-downgrade" # # # Same configuration as HTTP version... # # Redirect HTTP to HTTPS (uncomment after SSL setup) # # ServerName your-domain.com # ServerAlias www.your-domain.com # Redirect permanent / https://your-domain.com/ #