# ===== SIRA ROOT SECURITY =====
# - Nonaktifkan directory listing
# - Proteksi sensitif file
# - XSS / Clickjacking protection headers
Options -Indexes -MultiViews
DirectoryIndex index.php

# ===== Header Security Global =====
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(self)"
    Header unset X-Powered-By
</IfModule>

# ===== Proteksi File Sensitif =====
<FilesMatch "^(\.env|\.htaccess|\.htpasswd|composer\.(json|lock)|package(-lock)?\.json|README(\.md)?|.*\.ini|.*\.sql|.*\.log)$">
    Require all denied
    Order allow,deny
    Deny from all
</FilesMatch>

# ===== PHP Error Hide di Production (Overwrite php.ini) =====
<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag log_errors On
    php_value error_log "php_errors_sira.log"
</IfModule>
<IfModule mod_php7.c>
    php_flag display_errors Off
</IfModule>
<IfModule mod_php8.c>
    php_flag display_errors Off
</IfModule>
