# Refuse to serve any file in this directory directly. Files here are only
# returned to authenticated users through the /api/downloads/* endpoints
# after their one-time signed token has been validated. This rule covers
# Apache + mod_rewrite. The PHP endpoints always verify the absolute path
# against the storage root, but defense-in-depth doesn't hurt.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule . - [F,L]
</IfModule>

# Fallback for hosts that don't have mod_rewrite (rare, but cheap to add).
<IfModule !mod_rewrite.c>
  <FilesMatch ".+">
    Require all denied
  </FilesMatch>
</IfModule>
