comunes/tane
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

feat(web): SEO/social cards, security headers, PWA icons, FAQ, status, get-involved, captions

Browse source
This commit is contained in:
vjrj 2026-07-15 12:10:30 +02:00
parent a719e9c172
commit a3697e6b3e
19 changed files with 358 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

11
site/nginx.conf
View file

@ -4,6 +4,17 @@ server {
root /usr/share/nginx/html;
index index.html;
# Security headers. The page is fully static and self-contained: inline CSS
# (needs style-src 'unsafe-inline'), same-origin images (+ data: URIs), no
# third-party scripts. HSTS is host-scoped (no includeSubDomains) so it can't
# affect sibling *.comunes.org sites. TLS is terminated upstream (assange).
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Frame-Options "DENY" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), interest-cohort=()" always;
add_header Strict-Transport-Security "max-age=15768000" always;
# Hugo emits directory-style URLs (/legal/privacy/index.html).
location / {
try_files $uri $uri/ =404;