Options -Indexes
DirectoryIndex index.php

<FilesMatch "^(config\.php|config\.php\.example|database\.sql)$">
  Require all denied
  Deny from all
</FilesMatch>

RewriteEngine On
# Preserve bearer authentication for PHP on Apache/Passenger configurations.
RewriteCond %{HTTP:Authorization} .
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Route only API calls to the single PHP application controller.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^api/?(.*)$ index.php?api=$1 [QSA,L]

# Do not permit direct access to deployment/runtime directories.
RewriteRule ^(?:data|exports|database)(?:/|$) - [F,L]
