RewriteEngine On
Options -Indexes

# The hosted InfinityFree installation lives directly in htdocs. Redirect
# legacy links that still include the local XAMPP /tupsan directory name.
RewriteRule ^tupsan(?:/(.*))?$ /$1 [R=302,L,NE]

# Source/setup files must never be downloadable through Apache.
<FilesMatch "\.(sql|ps1|txt|md|ini|cnf|env|json|log|bak|old|key|csr)$">
    Require all denied
</FilesMatch>

# Deny hidden files such as .env, while Apache keeps using this .htaccess.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Mobile browsers require a secure context for device GPS. Keep localhost
# available for local development, but redirect LAN clients to local HTTPS.
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:[0-9]+)?$ [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L,NE]
