Options -Indexes

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^api/(.*)$ api/index.php?path=$1 [QSA,L]
</IfModule>

<IfModule mod_mime.c>
  AddType text/javascript .mjs
  AddType application/javascript .js
  AddType font/woff2 .woff2
  AddType font/woff .woff
  AddType font/ttf .ttf
</IfModule>

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set Referrer-Policy "strict-origin-when-cross-origin"

  <FilesMatch "\.(?:js|mjs|css|svg|woff2?|ttf)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>

  <FilesMatch "\.(?:js|mjs|css|json|svg|woff2?|ttf)$">
    Header set Access-Control-Allow-Origin "*"
    Header set Access-Control-Allow-Methods "GET, OPTIONS"
    Header set Access-Control-Allow-Headers "Origin, Range, Accept-Encoding, Referer"
  </FilesMatch>
</IfModule>

<FilesMatch "^(config\.local\.php|.*\.json|.*\.lock)$">
  Require all denied
</FilesMatch>