# NEXUS POS — root .htaccess
# All traffic is served from /public (rules 102-104: uploads & code stay out of reach).
# Sensitive folders are hard-blocked (rules 8, 69, 148).

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block direct access to application internals
    RewriteRule ^(app|config|database|storage|install|helpers)/ - [F,L]

    # Block dot files (.env, .git ...)  (rule 148)
    RewriteRule (^|/)\. - [F,L]

    # Serve the public front controller
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/index.php [L,QSA]
</IfModule>

<FilesMatch "\.(env|lock|log|sql|md|json)$">
    Require all denied
</FilesMatch>

Options -Indexes
