.htaccess

Options -Indexes
ExpiresActive On

<FilesMatch "\.(ico|png|jpe?g|gif|bmp|svg|mov|mp4|webp|webm|mp3|wav|ogg|woff|woff2|js|css)$">
  ExpiresDefault "access plus 1 year"
</FilesMatch>

#
# 02/2024: far future expires on dynamically-fetched HTML fragments.
# this matches the html/ path without requiring a separate .htaccess file in that directory.
# note that # is just another start / end character, to avoid escaping slashes.
# https://stackoverflow.com/questions/868088/apache-filesmatch-matching-a-folder-in-the-regular-expression
# TODO: restrict to also requiring .VXXX?
#
<If "%{REQUEST_URI} =~ m#^.*/html/.*\.(html)#">
  ExpiresByType text/html A31536000
  AddDefaultCharset UTF-8
</If>

#
# 08/12/2023: Explicit far future expires headers on some MIME types
# because the above rule doesn't seem to catch everything... ¯\_(ツ)_/¯
#

# access + 1 year, in seconds
ExpiresByType image/png A31536000
ExpiresByType image/jpg A31536000
ExpiresByType image/gif A31536000

ExpiresByType text/javascript A31536000
ExpiresByType text/css A31536000
ExpiresByType image/svg+xml A31536000

# allow cache-busting params for unique URLs that still hit the original asset on disk.
# e.g., image.png.v2 -> image.png
RewriteRule (.*)\.(.*)\.[vV]\d+$ $1.$2 [L]

# UTF-8, please.
AddCharset utf-8 .html .css .php .txt .js

# Allow CORS on certain stuff, armor-alley.net -> play.armor-alley.net
# This applies only if you are the owner of said domains. ;)
<FilesMatch "\.(json|woff|woff2)$">
    Header set Access-Control-Allow-Origin "https://armor-alley.net"
</FilesMatch>