# DarkWire for the web on Apache 2.4 (mod_headers, mod_mime). Shipped as .htaccess: it works when
# the server allows it (AllowOverride FileInfo Indexes AuthConfig), otherwise copy these lines into
# the site's configuration. The site must be on https:// — browsers only allow push, service
# workers and drives there. relay.php needs PHP 8.1 or newer.

DirectoryIndex index.html
AddType application/wasm .wasm
AddType application/manifest+json .webmanifest

<IfModule mod_headers.c>
	Header always set X-Content-Type-Options "nosniff"
	Header always set Referrer-Policy "no-referrer"
	Header always set X-Frame-Options "DENY"
	Header always set Permissions-Policy "camera=(self), microphone=(self), geolocation=()"
	# Always fresh: the page and its service worker decide which version runs.
	<FilesMatch "^(index\.html|sw\.js|manifest\.webmanifest)$">
		Header set Cache-Control "no-cache"
	</FilesMatch>
	# Hashed file names: never change.
	<If "%{REQUEST_URI} =~ m#/assets/#">
		Header set Cache-Control "public, max-age=31536000, immutable"
	</If>
</IfModule>

# The relay's extra push services are nobody else's business.
<Files "relay-hosts.txt">
	Require all denied
</Files>

# A site with tidy URLs above this folder (e.g. "strip .php") would redirect relay.php, and a
# redirected POST turns into a GET: the rewrite rules of the folders above stop here.
<IfModule mod_rewrite.c>
	RewriteEngine Off
</IfModule>
