RewriteEngine On

# ══════════════════════════════════════════════════════════════════════════
# MANUTENZIONE (flag-gated): se esiste <docroot>/../.maintenance, OGNI richiesta
# → HTTP 503 + maintenance.html. Bypass: ?mnt=<token> o cookie nis2_mnt=<token>.
# Accendere: touch ../.maintenance  ·  Spegnere: rm ../.maintenance  (istantaneo)
# ══════════════════════════════════════════════════════════════════════════
ErrorDocument 503 /maintenance.html
RewriteCond %{DOCUMENT_ROOT}/../.maintenance -f
RewriteCond %{REQUEST_URI} !^/maintenance\.html$
RewriteCond %{QUERY_STRING} !(^|&)mnt=efc088d042032889b64b887d2e562ec8(&|$)
RewriteCond %{HTTP_COOKIE} !nis2_mnt=efc088d042032889b64b887d2e562ec8
RewriteRule ^ - [R=503,L]

# Pass Authorization header to PHP-FPM
RewriteCond %{HTTP:Authorization} .+
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Redirect HTTP to HTTPS (production)
# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# If file or directory exists, serve directly
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

# Route everything through index.php
RewriteRule ^(.*)$ index.php [QSA,L]