# ── Nexora Esports – CPanel Passenger WSGI ──

# Force HTTPS (if SSL is active on CPanel)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Block access to sensitive files (NEVER serve .env or .db over HTTP)
RewriteRule \.env - [F,L]
RewriteRule \.db  - [F,L]
RewriteRule \.secret_key - [F,L]
RewriteRule \.git - [F,L]

# Payment proof screenshots are private. Apache may serve /static before Flask,
# so block direct public access and let admins view proofs through protected app routes.
RewriteRule ^static/Images/Registrations/ - [F,L,NC]
RewriteRule ^media/Images/Registrations/ - [F,L,NC]

# Passenger-managed: all other requests go to passenger_wsgi.py
# Static files (CSS/JS/images) are served by Apache directly for speed
