mirror of
https://github.com/andwati/andwati.com.git
synced 2026-10-18 01:12:53 +00:00
andwati
f87b818201
Production (Dokploy/Docker) was sending no security headers at all - static/_headers and wrangler.toml were Cloudflare Pages/Workers config that static-web-server never reads. Added sws.toml with the same CSP/security headers and the two redirects from _redirects, wired into the Dockerfile. Removed wrangler.toml, static/_headers, static/_redirects, the wrangler devDependency/deploy script, and related .gitignore/.dockerignore entries since Cloudflare deploy is no longer used. Also fixed a console error in theme.js where the Utterances postMessage call could fire before the comments iframe navigated to utteranc.es.
22 lines
1.0 KiB
TOML
22 lines
1.0 KiB
TOML
[advanced]
|
|
|
|
[[advanced.headers]]
|
|
source = "**"
|
|
[advanced.headers.headers]
|
|
Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://utteranc.es https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://www.google-analytics.com; font-src 'self'; connect-src 'self' https://www.google-analytics.com https://cloudflareinsights.com; frame-src https://www.youtube-nocookie.com https://utteranc.es; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests"
|
|
X-Frame-Options = "DENY"
|
|
X-Content-Type-Options = "nosniff"
|
|
Referrer-Policy = "strict-origin-when-cross-origin"
|
|
Permissions-Policy = "camera=(), microphone=(), geolocation=(), interest-cohort=()"
|
|
Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload"
|
|
|
|
[[advanced.redirects]]
|
|
source = "/security.txt"
|
|
destination = "/.well-known/security.txt"
|
|
kind = 301
|
|
|
|
[[advanced.redirects]]
|
|
source = "/index.xml"
|
|
destination = "/rss.xml"
|
|
kind = 301
|