netlify.toml

### https://www.netlify.com/docs/netlify-toml-reference/
[build]
base = ""
publish = "public"
command = "make netlify"
functions = "functions"

[build.environment]
ZOLA_VERSION = "0.19.2"
# in case the netlify provided zola cannot be used:
# zola binary needs to be called from the sites/ directory
# BUILD_BIN = "../zola/zola"

[context.deploy-preview]
command = "make netlify NETLIFY_DEPLOY_URL=$DEPLOY_PRIME_URL"

[context.branch-deploy]
command = "make netlify NETLIFY_DEPLOY_URL=$DEPLOY_PRIME_URL"

# HEADERS
## https://www.netlify.com/docs/headers-and-basic-auth/
## https://play.netlify.com/headers
### https://securityheaders.io/
### https://scotthelme.co.uk/a-new-security-header-referrer-policy/
### https://scotthelme.co.uk/a-new-security-header-expect-ct/
## Time hints:
## 1h = 3600
## 1d = 86400
## 7d = 604800
## 30d = 2592000
## 180d = 15552000
## 365d = 31536000
## 2y = 63072000

## NOTE: Certain automatically injected headers need to be overwritten only
#        by case sensitive header names: Content-Type, not content-type.
#        This is sad, netlify, very sad!

[[headers]]
for = "/*"
[headers.values]
# common cache control header for all resources;
# override with further rules
Cache-Control = "public, max-age=3600"

# Casing for STS is important to override value from Netlify:
Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload"

# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
content-security-policy = "base-uri 'self'; default-src 'self'; img-src 'self' data:; object-src 'none'; frame-src 'self' www.youtube-nocookie.com www.youtube.com player.vimeo.com; frame-ancestors 'none'; form-action 'none'; upgrade-insecure-requests; report-to default; report-uri https://markentiertech.report-uri.com/r/d/csp/enforce"

# A bunch of new CO*P headers
cross-origin-embedder-policy-report-only = "require-corp; report-to=\"default\""
cross-origin-opener-policy-report-only = "same-origin; report-to=\"default\""
cross-origin-resource-policy = "same-site"

# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/NEL
NEL = """{"report_to":"default","max_age":10886400}"""

report-to = """{"group":"default","max_age":31536000,"endpoints":[{"url":"https://markentiertech.report-uri.com/a/d/g"}],"include_subdomains":true}"""

# opt out of »Federated Learning of Cohorts (aka "FLoC")« - https://amifloced.org/
permissions-policy = "interest-cohort=(), accelerometer=(), autoplay=(), camera=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(), usb=(), xr-spatial-tracking=()"
referrer-policy = "strict-origin-when-cross-origin"
expect-ct = "max-age=0, report-uri=\"https://markentiertech.report-uri.com/r/d/ct/enforce\""

x-content-type-options = "nosniff"
# @deprecated: x-frame-options = "SAMEORIGIN"
x-github-repo = "https://github.com/markentier/markentier.tech"
x-github-user = "https://github.com/asaaki"
x-xss-protection = "1; mode=block; report=https://markentiertech.report-uri.com/r/d/xss/enforce"
x-xss-pwnage = "<script>alert('XSS!');</script>"

# does not work :'-(
Server = "markentier.tech"

[[headers]]
for = "/"
[headers.values]
# webhint.io suggest this very short time
Cache-Control = "public, max-age=180"

# special treatment for the JSON feed
# be as open as possible (mostly for my personal testing)
[[headers]]
for = "/feed.json"
[headers.values]
Content-Type = "application/feed+json"
content-security-policy = "default-src 'self'; script-src *; child-src *; worker-src *"
access-control-max-age = "600"
access-control-allow-origin = "*"
access-control-allow-headers = "*"
access-control-expose-headers = "*"
access-control-allow-methods = "GET,OPTIONS"

[[headers]]
for = "/js/mtt.js"
[headers.values]
Cache-Control = "public, max-age=2592000"

[[headers]]
for = "/*.css"
[headers.values]
Cache-Control = "public, max-age=2592000"

[[headers]]
for = "/manifest.json"
[headers.values]
Content-Type = "application/json; charset=utf8"
Cache-Control = "public, max-age=2592000, immutable"

[[headers]]
for = "/*.svg"
[headers.values]
Cache-Control = "public, max-age=31536000, immutable"

[[headers]]
for = "/*.avif"
[headers.values]
Content-Type = "image/avif"
content-disposition = "inline"
Cache-Control = "public, max-age=31536000, immutable"
# since we needed to set security headers globally, we have to override on a per resource level;
# sadly Netlify also has no "unset" logic for custom headers
content-security-policy = "default-src *"
cross-origin-embedder-policy-report-only = "unsafe-none"
cross-origin-opener-policy-report-only = "unsafe-none"
cross-origin-resource-policy = "cross-origin"

[[headers]]
for = "/*.webp"
[headers.values]
Cache-Control = "public, max-age=31536000, immutable"
content-security-policy = "default-src *"
cross-origin-embedder-policy-report-only = "unsafe-none"
cross-origin-opener-policy-report-only = "unsafe-none"
cross-origin-resource-policy = "cross-origin"

[[headers]]
for = "/*.png"
[headers.values]
Cache-Control = "public, max-age=31536000, immutable"
content-security-policy = "default-src *"
cross-origin-embedder-policy-report-only = "unsafe-none"
cross-origin-opener-policy-report-only = "unsafe-none"
cross-origin-resource-policy = "cross-origin"

[[headers]]
for = "/*.jpg"
[headers.values]
Cache-Control = "public, max-age=31536000, immutable"
content-security-policy = "default-src *"
cross-origin-embedder-policy-report-only = "unsafe-none"
cross-origin-opener-policy-report-only = "unsafe-none"
cross-origin-resource-policy = "cross-origin"

[[headers]]
for = "/*.ico"
[headers.values]
Cache-Control = "public, max-age=31536000, immutable"
content-security-policy = "default-src *"
cross-origin-embedder-policy-report-only = "unsafe-none"
cross-origin-opener-policy-report-only = "unsafe-none"
cross-origin-resource-policy = "cross-origin"

[[headers]]
for = "/*.webmanifest"
[headers.values]
Content-Type = "application/manifest+json; charset=utf8"
Cache-Control = "public, max-age=2592000"

# REDIRECTS
## https://docs.netlify.com/routing/redirects/

[[redirects]]
from = "/beacon.svg"
to = "/.netlify/functions/beacon_img"
status = 200
force = true # needed, since we do have a file there

[[redirects]]
from = "/posts/2018/03/from-cobalt-to-gutenberg/"
to = "/posts/2018/03/from-cobalt-to-zola/"
status = 301

[[redirects]]
from = "/posts/2018/03/from-cobalt-to-gutenberg"
to = "/posts/2018/03/from-cobalt-to-zola/"
status = 301

[[redirects]]
from = "/*"
to = "/404/index.html"
status = 404

[[plugins]]
package = "netlify-plugin-image-optim"

# [[plugins]]
# package = "@netlify/plugin-lighthouse"

# [[plugins]]
# package = "netlify-plugin-debug-cache"