# Enable rewrite engine
RewriteEngine On
# If using Passenger (Node.js selector)
# API routing
RewriteRule ^api/(.*)$ http://localhost:3000/api/$1 [P,L]
# Health check
RewriteRule ^health$ http://localhost:3000/health [P,L]
# Security headers
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-XSS-Protection "1; mode=block"
Header set Referrer-Policy "strict-origin-when-cross-origin"