Options -Indexes

<IfModule mod_rewrite.c>
RewriteEngine On

# Force HTTPS on the permanent machine endpoint.
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "no-referrer"
Header always set Cache-Control "no-store"
</IfModule>

# Never expose local logs, backups, or dot files through the API vhost.
<FilesMatch "(^\.|\.log$|\.txt$|\.bak$|\.sql$|\.zip$)">
  Require all denied
</FilesMatch>
