[Settings]

[build]
  publish = "dist/"

[[headers]]
  for = "/*"
  [headers.values]
    Access-Control-Allow-Origin = "*"
    Content-Security-Policy = """
        base-uri 'self';
        default-src 'none';
        font-src 'self' cdn.jsdelivr.net;
        form-action 'self';
        frame-ancestors 'none';
        frame-src 'self';
        img-src 'self' data:;
        manifest-src 'self';
        media-src 'self';
        object-src 'none';
        script-src 'self' cdn.jsdelivr.net;
        style-src 'self' cdn.jsdelivr.net;
        upgrade-insecure-requests;
    """
    Expect-CT = "max-age=86400; report-uri='https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct'"
    Feature-Policy = """
        accelerometer 'self';
        ambient-light-sensor 'self';
        autoplay 'self';
        camera 'self';
        document-domain 'self';
        encrypted-media 'self';
        fullscreen 'self';
        geolocation 'self';
        gyroscope 'self';
        magnetometer 'self';
        microphone 'self';
        midi 'self';
        payment 'self';
        picture-in-picture 'self';
        speaker 'self';
        sync-xhr 'self';
        usb 'self';
        vr / xr 'self';
    """
    Referrer-Policy = "strict-origin"
    Strict-Transport-Security = "max-age=31557600; includesubdomains; preload"
    Vary = "Accept-Encoding"
    X-Content-Type-Options = "nosniff"
    X-Frame-Options = "deny"
    X-XSS-Protection = "1; mode=block"

[[headers]]
  for = "*.css"
  [headers.values]
    Content-Type = "text/css; charset=utf-8"

[[headers]]
  for = "*.js"
  [headers.values]
    Content-Type = "text/javascript; charset=utf-8"

[[headers]]
  for = "*.webmanifest"
  [headers.values]
    Content-Type = "application/manifest+json; charset=utf-8"