DirectoryIndex index.php
Options -Indexes
RewriteEngine On
# pass the Authorization header (staff API Bearer keys) to PHP-FPM
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# everything that is not a real file (assets) goes to the front controller
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L,QSA]

# index.php is the only PHP file in the web root; old WHMCS *.php URLs are routed by it too
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
</IfModule>
