[build]
publish = "public"
# Use --minify to reduce HTML file size since Google is now tracking this
# as "Core Web Vitals".
command = "hugo --baseURL https://www.itix.fr --minify"

[build.environment] # Global
HUGO_VERSION = "0.167.0"

[context.production.environment] # Only for prod
HUGO_VERSION = "0.167.0"

[context.deploy-preview]
command = "hugo --buildDrafts --buildFuture --baseURL $DEPLOY_PRIME_URL"

[context.deploy-preview.environment]
HUGO_ENABLEGITINFO = "true"

# Security headers.
#
# HSTS is already set by Netlify (max-age=31536000). It does not include
# the subdomains of itix.fr on purpose.
#
# Content Security Policy:
# - no inline script (the search page uses a JSON data block + /js/search.js)
# - inline styles are allowed (style attributes generated by Hugo)
# - YouTube videos are embedded through iframes
# - if Plausible is enabled again, add https://plausible.io to script-src
#   and connect-src
[[headers]]
  for = "/*"

  [headers.values]
    Content-Security-Policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self'; media-src 'self'; frame-src https://www.youtube.com https://www.youtube-nocookie.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests"
    X-Content-Type-Options = "nosniff"
    X-Frame-Options = "DENY"
    Referrer-Policy = "strict-origin-when-cross-origin"

# The CSS file name contains a fingerprint of its content: it can be cached forever.
[[headers]]
  for = "/css/*"

  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

# The fonts are not fingerprinted but they almost never change.
[[headers]]
  for = "/fonts/*"

  [headers.values]
    Cache-Control = "public, max-age=2592000"

# Matrix homeserver discovery
[[headers]]
  for = "/.well-known/matrix/*"

  [headers.values]
    Content-Type = "application/json"
    Access-Control-Allow-Origin = "*"