# Drop into MEDIA_ROOT (the directory Apache serves the image derivatives from).
# PLANNING.md §7: Node writes the bytes, Apache serves them.

# Derivative paths are content-addressed ({page}/{sha256}/{width}.{ext}) so the
# bytes at a URL never change — cache them for a year, immutably.
<IfModule mod_headers.c>
  <FilesMatch "\.(avif|webp|jpe?g|png)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
    # The landing page and admin portal embed these images cross-origin.
    Header set Cross-Origin-Resource-Policy "cross-origin"
    Header set Access-Control-Allow-Origin "*"
  </FilesMatch>
</IfModule>

# Never render a directory listing.
Options -Indexes

# Nothing here is executable.
<FilesMatch "\.(php|cgi|pl|py|sh)$">
  Require all denied
</FilesMatch>