sverklo-site/netlify.toml at main · sverklo/sverklo-site · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
[build]
  publish = "."
  # Pre-deploy guards. If a stale version slips into a hardcoded place
  # the build fails before publishing — see scripts/lint-versions.mjs.
  command = "node --test scripts/build-mcp-index.test.mjs scripts/lint-versions.test.mjs scripts/patch-nav.test.mjs && node scripts/patch-nav.mjs && node scripts/build-mcp-index.mjs --canonical && node scripts/lint-versions.mjs"

[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Strict-Transport-Security = "max-age=31536000; includeSubDomains"
    Permissions-Policy = "camera=(), microphone=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), bluetooth=(), midi=(), interest-cohort=()"
    # Known limitation (P1-1): script-src uses 'unsafe-inline' because the page has many inline
    # event handlers that would need refactoring (to external listeners or nonces) before launch.
    # Revisit post-launch — migrate to nonce-based CSP or hash-based allowlist.
    Content-Security-Policy = "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; img-src 'self' https://img.shields.io https://badgen.net https://api.producthunt.com https://t.sverklo.com https://devhunt.org https://i.ytimg.com data:; connect-src 'self' https://registry.npmjs.org https://t.sverklo.com https://devhunt.org https://api.github.com; frame-src https://www.youtube-nocookie.com"

# Long-cache static assets (renames invalidate by URL change). Keep HTML at default short cache.
[[headers]]
  for = "*.png"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "*.jpg"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "*.svg"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "*.ico"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "*.gif"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "*.mp4"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
  for = "*.woff2"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

# Snapshots.json is regenerated per release — cache briefly, revalidate in background.
[[headers]]
  for = "*.json"
  [headers.values]
    Cache-Control = "public, max-age=3600, stale-while-revalidate=86400"

# Proxy dynamic badge SVGs to the Cloudflare Worker.
# Note: bare-URL convenience redirect (without .svg) was attempted but caused
# an infinite redirect loop because Netlify's `:repo` placeholder happily
# matches `sverklo.svg`, appending `.svg` again. The badge page and all docs
# use the `.svg` form explicitly — bare URLs are not supported.
[[redirects]]
  from = "/api/badge/*"
  to = "https://t.sverklo.com/v1/badge/:splat"
  status = 200
  force = true

[[redirects]]
  from = "/compare/"
  to = "/vs/"
  status = 301
  force = true

[[redirects]]
  from = "/compare/*"
  to = "/vs/:splat"
  status = 301
  force = true

[[redirects]]
  from = "/*"
  to = "/404.html"
  status = 404