# This directory holds the Node.js source/config for the realtime service.
# It must never be served by Apache — Node runs as its own process; Apache
# only reverse-proxies to it. Without this, files like .env (containing
# JWT_SECRET/INTERNAL_SOCKET_SECRET) would be publicly downloadable, since
# the parent .htaccess's rewrite-to-index.php rule only applies when the
# requested path does NOT already exist as a real file.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>
