# Everything that is not an existing file goes to index.php (MARZI calls /v1/products, /v1/staff/... under this folder).
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
    # Some hosts drop unknown headers unless they are handed on; MARZI's signature depends on these two.
    RewriteRule .* - [E=HTTP_X_MARZI_TIMESTAMP:%{HTTP:X-Marzi-Timestamp}]
    RewriteRule .* - [E=HTTP_X_MARZI_SIGNATURE:%{HTTP:X-Marzi-Signature}]
</IfModule>

# Keep the settings, the code and the notes out of reach from the web.
<FilesMatch "^(config(\.example)?\.php|pages-map\.php|README\.md|\.htaccess)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
Options -Indexes
