# Cloudflare Pages response headers.
#
# Hugo copies static/ verbatim into public/, so this file lands at the
# deploy output root, which is where Pages reads it from. Pages consumes
# the file rather than publishing it. Values here override what
# Cloudflare would otherwise send.
#
# Every value below was checked against the built public/index.html, not
# copied from a template. That page loads nothing: no script, img, link,
# iframe, form, video, audio, object or embed element, no style= or on*=
# attribute. It has exactly one inline <style> block, which
# themes/loravega/layouts/_default/baseof.html fills with the whole of
# themes/loravega/static/css/style.css via readFile. That inlining is a
# deliberate theme design choice, and it is the sole reason style-src
# needs 'unsafe-inline'.
#
# img-src 'self' is kept even though the page has no images. Browsers
# request /favicon.ico unprompted and that fetch is governed by img-src;
# measured in Chrome, with this allowance the request is made and 404s,
# and without it the request is suppressed outright. Neither hurts
# today, but same-origin images are the one resource class this site
# would plausibly grow, and 'self' loosens nothing cross-origin.
#
# X-Content-Type-Options and Referrer-Policy are already sent by
# Cloudflare by default and are restated here on purpose. They are a
# default, not a guarantee, and this file is where the site's header
# posture is declared.
#
# Strict-Transport-Security deliberately carries neither preload nor
# includeSubDomains. preload is effectively irreversible and is the
# owner's call. includeSubDomains would bind every hostname under
# lora.vegas for a year, and it buys nothing today: www.lora.vegas is
# the only other name in DNS, it is served by this same Pages project,
# so this block sets HSTS on its responses directly.

/*
  Strict-Transport-Security: max-age=31536000
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  X-Frame-Options: DENY
  Permissions-Policy: geolocation=(), microphone=(), camera=()
  Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'