# ADAMETZ.MEDIA — Apache-Konfiguration (adametz.media)
# Kanonische Domain: https://adametz.media (ohne www)

# ── Rewrite-Engine ────────────────────────────────────────────────────────────
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # HTTPS erzwingen und www → non-www (301 Permanent)
  RewriteCond %{HTTPS} off [OR]
  RewriteCond %{HTTP_HOST} ^www\.adametz\.media$ [NC]
  RewriteRule ^ https://adametz.media%{REQUEST_URI} [R=301,L]

  # Build-Skript und interne Dateien nicht öffentlich
  RewriteRule ^scripts/ - [F,L]
  RewriteRule ^assets/components/ - [F,L]
  RewriteRule ^assets/version\.txt$ - [F,L]
</IfModule>

# ── Fehlerseiten ──────────────────────────────────────────────────────────────
ErrorDocument 404 /404.html

# ── Verzeichnislisting deaktivieren ───────────────────────────────────────────
Options -Indexes -MultiViews

# ── Standard-Dokument ─────────────────────────────────────────────────────────
DirectoryIndex index.html

# ── Zeichensatz ───────────────────────────────────────────────────────────────
AddDefaultCharset UTF-8

# ── MIME-Typen ────────────────────────────────────────────────────────────────
<IfModule mod_mime.c>
  AddType image/webp .webp
  AddType image/svg+xml .svg
  AddType font/woff2 .woff2
  AddType font/woff .woff
</IfModule>

# ── Kompression ───────────────────────────────────────────────────────────────
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
  AddOutputFilterByType DEFLATE application/javascript application/json application/xml
  AddOutputFilterByType DEFLATE image/svg+xml font/woff2 font/woff
</IfModule>

<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/css text/xml
  AddOutputFilterByType BROTLI_COMPRESS application/javascript application/json application/xml
  AddOutputFilterByType BROTLI_COMPRESS image/svg+xml font/woff2 font/woff
</IfModule>

# ── Cache-Steuerung ───────────────────────────────────────────────────────────
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 0 seconds"

  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType text/css "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/svg+xml "access plus 7 days"
  ExpiresByType image/webp "access plus 7 days"
  ExpiresByType image/jpeg "access plus 7 days"
  ExpiresByType image/png "access plus 7 days"
  ExpiresByType font/woff2 "access plus 7 days"
  ExpiresByType font/woff "access plus 7 days"
</IfModule>

<IfModule mod_headers.c>
  SetEnvIf Request_URI "^/assets/" ASSET_PATH=1
  Header set Cache-Control "public, max-age=604800, immutable" env=ASSET_PATH

  <FilesMatch "\.(html)$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>

  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self' mailto:"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>

# ── Zugriffsschutz ────────────────────────────────────────────────────────────
<FilesMatch "(^\.|\.md$|\.DS_Store$)">
  Require all denied
</FilesMatch>

<FilesMatch "(^|/)version\.txt$">
  Require all denied
</FilesMatch>