mirror of
https://github.com/avinal/avinal.github.io.git
synced 2026-07-03 23:30:09 +05:30
avinal
a8c7e06330
Reveal.js, Mermaid, and highlight.js load from cdnjs.cloudflare.com and cdn.jsdelivr.net. Add a path-specific CSP override for /talks/* so these CDN resources are not blocked.
22 lines
1.2 KiB
TOML
22 lines
1.2 KiB
TOML
[build]
|
|
command = "npm run build"
|
|
publish = "dist"
|
|
|
|
[build.environment]
|
|
NODE_VERSION = "22"
|
|
|
|
[[headers]]
|
|
for = "/*"
|
|
[headers.values]
|
|
X-Frame-Options = "DENY"
|
|
X-Content-Type-Options = "nosniff"
|
|
Referrer-Policy = "strict-origin-when-cross-origin"
|
|
Permissions-Policy = "camera=(), microphone=(), geolocation=()"
|
|
X-XSS-Protection = "1; mode=block"
|
|
Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline' https://cal.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' https: data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.listenbrainz.org https://coverartarchive.org https://itunes.apple.com https://api.github.com https://wakatime.com; frame-src https://cal.com;"
|
|
|
|
[[headers]]
|
|
for = "/talks/*"
|
|
[headers.values]
|
|
Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; img-src 'self' https: data:; font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com; connect-src 'self';"
|