Options +FollowSymlinks
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

RewriteCond %{HTTPS} !=on


Options -Indexes

# deal with admin first
RewriteCond %{REQUEST_URI} ^/e-penalty/(admin)
RewriteRule ^admin/assets/(.*)$ backend/web/assets/$1 [L]
RewriteRule ^admin/css/(.*)$ backend/web/css/$1 [L]
RewriteRule ^admin/js/(.*)$ backend/web/js/$1 [L]
RewriteRule ^admin/theme/(.*)$ backend/web/theme/$1 [L]
RewriteRule ^admin/upload/(.*)$ backend/web/upload/$1 [L]
RewriteRule ^admin/fonts/(.*)$ backend/web/fonts/$1 [L]
RewriteRule ^admin/admin/(.*)$ backend/web/admin/$1 [L]
RewriteRule ^admin/adminassets/(.*)$ backend/web/adminassets/$1 [L]

RewriteCond %{REQUEST_URI} !^/e-penalty/backend/web/(assets|css|js|theme|upload|admin|adminassets)/
RewriteCond %{REQUEST_URI} ^/e-penalty/(admin)
RewriteRule ^.*$ backend/web/index.php [L]

#frontend
RewriteRule ^$ /e-penalty/site/index [L,R=301]
RewriteCond %{REQUEST_URI} ^/e-penalty/(assets|css|theme|js|upload_doc)
RewriteRule ^assets/(.*)$ frontend/web/assets/$1 [L]
RewriteRule ^upload/(.*)$ frontend/web/upload/$1 [L]
RewriteRule ^css/(.*)$ frontend/web/css/$1 [L]
RewriteRule ^js/(.*)$ frontend/web/js/$1 [L]
RewriteRule ^theme/(.*)$ frontend/web/theme/$1 [L]
RewriteRule ^upload_doc/(.*)$ frontend/web/upload_doc/$1 [L]

RewriteCond %{REQUEST_URI} !^/e-penalty/(frontend|backend)/web/(assets|css|js|theme|upload|upload_doc)/
RewriteCond %{REQUEST_URI} !index.php
RewriteCond %{REQUEST_FILENAME} !-f [OR]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^.*$ frontend/web/index.php


<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self';"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer"
    Header always set X-XSS-Protection "1; mode=block"
</IfModule>
