Options -Indexes -MultiViews
DirectoryIndex disabled
ServerSignature Off

# Daraja B2C production integration. This subdomain's document root is the

# trading-backend folder itself, so callback URLs must not include that folder.

SetEnv DARAJA_B2C_BASE_URL https://api.safaricom.co.ke

# Local XAMPP serves this project below /trading-backend. Daraja must use the

# complete public path when ngrok is forwarding localhost:80.

SetEnv DARAJA_B2C_CALLBACK_BASE_URL https://1de8-102-213-209-2.ngrok-free.app/trading-backend

# STK callback for the local XAMPP environment. Replace only this value on
# production with the public backend endpoint (without /trading-backend when
# the subdomain document root is the trading-backend folder).
SetEnv DARAJA_STK_CALLBACK_URL https://1de8-102-213-209-2.ngrok-free.app/trading-backend/payments/stk_ack.php

RewriteEngine On

# This host is an API-only backend, not a website. Its root deliberately

# returns 404, while the approved PHP endpoint paths remain available.

RewriteRule ^$ - [R=404,L]

# Never expose source, server processes, schedules, dependencies, secrets or

# database exports over HTTP. These rules do not stop PHP from including them.

RewriteRule ^(?:config|cron|trading-server|vendor)(?:/|$) - [F,L,NC]
RewriteRule ^(?:\.git|\.svn|\.hg)(?:/|$) - [F,L,NC]
RewriteRule ^(?:nexas\.sql|package(?:-lock)?\.json|composer\.(?:json|lock)|\.env(?:\.._)?|._\.(?:log|bak|sql|ini|dist|fla|psd))$ - [F,L,NC]

<FilesMatch "^(?:\.ht|\.git|\.env|nexas\.sql|package(?:-lock)?\.json|composer\.(?:json|lock)|phpunit\.xml)$">
Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Cross-Origin-Resource-Policy "same-site"
</IfModule>

# These paths assume this folder is the subdomain document root, e.g.

# https://backend.nexobinary.com/. For local XAMPP, use /trading-backend/errors/

# instead if you want the custom local error pages as well.

ErrorDocument 403 /errors/403.html
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html
