# ============================================================
# IRON Capital Asset Management — Apache / cPanel configuration
# Security · Performance · Caching · Compression · HTTPS
# ============================================================

Options -Indexes
ServerSignature Off
DirectoryIndex index.html

# ------------------------------------------------------------
# 1. Force HTTPS + strip www (canonical host)
# ------------------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On

  # HTTP -> HTTPS
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # www -> non-www
  RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
</IfModule>

# ------------------------------------------------------------
# 2. Security headers
# ------------------------------------------------------------
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=(), interest-cohort=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  # HSTS (2 years, preload) — enable once HTTPS is confirmed working sitewide
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
  # Content Security Policy — allows self, Google Fonts, inline styles/JSON-LD, https images
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' mailto:; object-src 'none'; upgrade-insecure-requests"
  # Drop the powered-by header
  Header unset X-Powered-By
</IfModule>

# ------------------------------------------------------------
# 3. Compression (gzip / deflate)
# ------------------------------------------------------------
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/x-javascript application/json
  AddOutputFilterByType DEFLATE application/xml application/rss+xml application/manifest+json
  AddOutputFilterByType DEFLATE image/svg+xml application/vnd.ms-fontobject font/ttf font/otf font/woff font/woff2
</IfModule>

# ------------------------------------------------------------
# 4. Browser caching (Core Web Vitals / repeat visits)
# ------------------------------------------------------------
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault                          "access plus 1 month"
  ExpiresByType text/html                 "access plus 0 seconds"
  ExpiresByType text/css                  "access plus 1 year"
  ExpiresByType application/javascript    "access plus 1 year"
  ExpiresByType image/jpeg                "access plus 1 year"
  ExpiresByType image/png                 "access plus 1 year"
  ExpiresByType image/webp                "access plus 1 year"
  ExpiresByType image/avif                "access plus 1 year"
  ExpiresByType image/svg+xml             "access plus 1 year"
  ExpiresByType image/x-icon              "access plus 1 year"
  ExpiresByType font/woff2                "access plus 1 year"
  ExpiresByType application/manifest+json "access plus 1 week"
  ExpiresByType application/xml           "access plus 1 day"
</IfModule>

<IfModule mod_headers.c>
  # Long-cache fingerprinted static assets, always revalidate HTML
  <FilesMatch "\.(css|js|jpg|jpeg|png|webp|avif|svg|ico|woff2)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
  <FilesMatch "\.(html)$">
    Header set Cache-Control "public, max-age=0, must-revalidate"
  </FilesMatch>
</IfModule>

# ------------------------------------------------------------
# 5. Correct MIME types
# ------------------------------------------------------------
<IfModule mod_mime.c>
  AddType image/webp .webp
  AddType image/avif .avif
  AddType application/manifest+json .webmanifest
  AddType image/svg+xml .svg
  AddType font/woff2 .woff2
</IfModule>

# ------------------------------------------------------------
# 6. Friendly error page (optional — falls back to index)
# ------------------------------------------------------------
ErrorDocument 404 /404.html
