# BEGIN OBELISK WEB PROTECTION
# Managed rules; custom directives outside this block are preserved.
<FilesMatch "(?i)(^\.|~$|\.(?:json|log|db(?:-wal|-shm|-journal)?|sqlite(?:3)?(?:-wal|-shm|-journal)?|lic|old|bak|backup|orig|save|swp|sql|tmp|lock|initialized|zip|tar|gz|tgz|bz2|xz|7z|pem|key)(?:\.[0-9]+)?$)">
    Require all denied
</FilesMatch>
<FilesMatch "^(?:kernel_.*|config|obelisk_2fa\.key|cron_[A-Za-z0-9_]+|AccessPolicy|ActionCenter|ActionCenterPreview|ActionCenterSignals|ActionCenterStore|ActivationAccess|AdminRecovery|AiAssistant|AiInsights|AiPeriodPolicy|AiRequestThrottle|AiResultPolicy|AiSamplingPolicy|AiScoringPolicy|AmiClient|AnalysisSupport|AnsweredTransferMigration|AppDatabase|AppStore|AssistedUpdate|AsteriskConcise|AudioErrorPolicy|AudioFormatPolicy|AudioWorkerDiagnostic|AudioWorkerPolicy|CompanyIdentity|ConfigurationBackup|ContactJourneyReport|ControlStyle|CoverageScenarios|CronJobLock|CronReadiness|CronRunner|CsvCell|Customization|ExtensionManager|FreePbxNumberContext|FreePbxQueueCatalog|FreePbxTrunkCatalog|GeminiClient|GeminiFailurePolicy|GeminiModelCatalog|GeminiResponsePolicy|GeoIpDatabase|GuidedTour|HistoryManager|HistoryMetrics|HistoryPruner|HttpUploadLimits|ImportSqlUpgrade|InstallationDiagnostics|InstallationHealth|InstallationInitializer|JobHealth|JsonConfig|LicenseAccess|LicenseActivation|LicenseActivationThrottle|LicenseHttpClient|LicenseText|MapTileSettings|NavigationCatalog|NavigationSupport|ObeliskI18n|ObeliskLog|ObeliskSecurity|ObeliskWeb|OperationalAudit|OperationalConfig|OperationalHealth|OperationalInventory|OperationalSettings|PasswordPolicy|PbxTimezone|PermissionsDiagnostics|PermissionsRepair|PhoneGeographyCatalog|PhoneGeographyLookup|PlainDescription|PrivilegedFilesystem|QualityComparison|QueueCoverage|QueueEventCatalog|QueueLoadHistory|QueueLogSource|QueueManager|QueueNumberPolicy|QueueNumberSettings|QueueNumberUpgrade|QueueReportNames|QueueTrafficForecast|RecordingActivity|RecordingAnalysisPresentation|RecordingBacklog|RecordingBacklogTransfer|RecordingCatalog|RecordingCleaner|RecordingFilename|RecordingManager|RecordingPeriod|RecordingRetention|RecordingSchema|RecordingStream|ReportDataMaintenance|ReportDatabase|ReportIndexUpgrade|ReportPresentation|ReportQueryDeadline|ReportSupport|RetiredFileCleanup|RoutineGrantGuard|RoutingRecordings|RuntimeStorage|SchemaBackup|SchemaMigration|SchemaUpdaterProfile|SecurityPolicy|SessionMaintenance|SessionPolicy|SessionPresentation|SettingsCatalog|SettingsConnectionCheck|SignedLicense|SmtpMailer|SqlNaturalOrder|StoragePaths|TourCatalog|TrafficQueryBudget|TwoFactor|UiSupport|UpdateGate|UpdateMaintenance|UserPreferences|VideowallSnapshot|WebProtection)\.php$">
    Require all denied
</FilesMatch>
# Internal implementation and development material are never public endpoints.
RedirectMatch 404 /(?:\.git|work|outputs|tests|distribution|maintenance|includes|data|logs|utility)(?:/|$)
# Assets and vendored PHP libraries are filesystem includes, never web endpoints.
# Also deny PATH_INFO and multiple extensions (for example image.php.jpg).
RedirectMatch 403 "(?i)/assets/.*\.(?:php[0-9]*|phtml|pht|phar|phps)(?:[./]|$)"
Options -Indexes
# END OBELISK WEB PROTECTION
