overkill-hill/_headers at main · OKHP3/overkill-hill · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# OverKill Hill P³ — edge headers
# Format compatible with Cloudflare Pages / Netlify _headers files.
# If served by Cloudflare directly, mirror these via Transform Rules.

/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), serial=(), sync-xhr=(), usb=(), web-share=(self), xr-spatial-tracking=()
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

  # Modern cross-origin isolation (Spectre mitigation, MDN 2024+ recommended baseline).
  # COOP forces a top-level browsing context group. CORP same-origin keeps our assets
  # from being embedded by other origins. Origin-Agent-Cluster isolates our origin
  # into its own agent cluster (better process isolation in Chromium).
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Resource-Policy: same-origin
  Origin-Agent-Cluster: ?1

  # CSP is generated by scripts/generate-csp.py from the deployed HTML.
  # The page meta tags use per-class hashes; this header is the union needed
  # by every page and is enforced at the edge. Keep it generated, not hand-edited.
  Content-Security-Policy: default-src 'self'; script-src 'self' https://www.googletagmanager.com 'sha256-+DZGcLbJmHkKnPona6nBHFWkoeOkpTI8vQnZZ3Z1wyk=' 'sha256-2NPQY0ewseycVRsC+HHUhYLy0axbXFwhzfvpOSU+nIw=' 'sha256-3Cackdtp7Do2OrDkhZ8HQxibdFsvQhw0sUCB/9aSLkI=' 'sha256-3e+uz8JyUVREayOofGtT7xzNexRt5TCg6RldkSFGZwk=' 'sha256-4rs1GhG4jH6g9YTwg6mvRmmHv7bjyUH7GvZnMekLv8k=' 'sha256-54HVTXWFw7Zkr6ae0qjzYmuEfX7zeNPSmmgBbGcvXYA=' 'sha256-57wI2U/qr1O6ptBywIuIr7i+I356rhGPUzQu7ritMQQ=' 'sha256-6DuhTBpiipuy9jERXvPLChPCwm7AsB7YeVZHJ5ksPQk=' 'sha256-6qQFrumK+MBJP2jBD5/c2oyyWQl9kmfvYhkrAHbwAQI=' 'sha256-7//FvIo12Na/Gl24V5LF1JFIQrbnz6eFUWZuNysAJ98=' 'sha256-7cBx9QY/Bh31VpbxxCQoRsGJ3skKVq33jJgT/WH+yDc=' 'sha256-7kS4taYxOotanhpObMfQ3o0rgebN1P3aqxrG1oJavMY=' 'sha256-7xDjo2X53t3p3w5O/66XkJRrLrYP4BolkoKOjhBaQ18=' 'sha256-8ER2+OkzKCugkK7Vm/Uk9Q8wG9+QfLmIBVTgWlN7/mg=' 'sha256-9+gDIB/FoOZbtN1NX7WLQUlPsi9h3u6HN1J0LVyv/44=' 'sha256-99UQai5rp0hhaOiU/AJWBeJOyVoO6s+t372hxKjIioY=' 'sha256-AA2PW7k11qt91Zc8yW1+ZfayiKhkDFCQsf15o1P30IQ=' 'sha256-AoOtS/Oy98lq33Bzi2Ql2ULsxM3fbrxb09xvuAGMkWw=' 'sha256-Dt2gj8QI0GHTnQZpQbGdHujIgwdIxlzk14DY3nGy4sI=' 'sha256-EMLH+980LqZl0pVyyZweiWp1k+JiwFypRqJ45s2YvN0=' 'sha256-Eewh7H9ZxGXhOROAT6ITI6PCzUI/Re68kTe6NDdRHSs=' 'sha256-FIbAjLPhrxn+tkhBj80dTe8aQixOKjtSq44SIFGmQmg=' 'sha256-HzFFMp/0HhdVappRZCsyKGXxSRmaRe+VFcMWPWZj8Hc=' 'sha256-J/vneuEsWSj5XLlsAovY/jIU503IfRySbtkL77I1j6U=' 'sha256-JBQs811PU2SDIiFQkHh9Qx2p4Pu0ZgwJbTQb8JuaLkQ=' 'sha256-JMyr3Pxl9VQui6820YcOMyUBWroXCUutuhfps8+ZWhI=' 'sha256-JSwcPjWGXDAYaTZGfCB+6cpd0/AW82XCWneB7fLvyJo=' 'sha256-JcnFHpoLBroEu/WlUr4fHL8SRGYk/fKHdvVqQ5H0kSM=' 'sha256-KPE5ui6CfQFY1vcShV5JQqG/wFuo8fkRFVxhoOlZo8A=' 'sha256-KVtCu6gsjaQElccFMMifvbE1jLHXwFA78succB1lZkc=' 'sha256-MFYz70iy3U337WGDTrlJD5y3SPjHty4x4xiNwwt3eXM=' 'sha256-OAONgQjqD0jx821ebrSh+nheLk0gXXQQQ/9iqNKQm80=' 'sha256-Onl0f/cB5mLfyrrQukG9H6HRVimBA+jiu8yf0axtdB4=' 'sha256-PsT56SeTrRi7aoxIks+q3FRFfL6mht7BZ64qaBqSUoU=' 'sha256-SEHWdY59isAzkbHGHWllo65NDvHkHxeUkDe5F3kHRQY=' 'sha256-STmaN+6lMvCR9wPObeDHm9914SI5bqfxgUYrResP2Hs=' 'sha256-T9loXrLLqKJj9qj+sKa3oT1TD2r9eEpjmnVd6OBSCM8=' 'sha256-Tas+0h0CkkBgZYJbPhHpNPO3V3PfPz8NXZJSp/H7xKY=' 'sha256-WSDkVylC2ryMql5mrf9gYiOpx45jep9Nmq96Yi2igzM=' 'sha256-WWf3hBnOj3Rat/lZq/+EP01wLY+BbdDtt5GC8wVX0Vg=' 'sha256-WwnnOCDpTxPsK2RDrm6unyMaoiIBSRhanv1aPVlHyRc=' 'sha256-XQY1ILfhzl3LU6wEDMfRAS5cL5MTOacNSaDtIetzkN0=' 'sha256-ZCip9CRySfoKaD5D2GhNFISP5pMJCXca5ESTFC14RuQ=' 'sha256-aYDgiWZxnM6bkmW6OlNuffanXBuwJSbt2/PmzP663gw=' 'sha256-avRAphKqPQHMltVgbPMK3Aby3Te149GDk6AInGNqybw=' 'sha256-bQeG3wkgT3Z17xF+L0egnr+92D4uADxrE7UZvPoCz/E=' 'sha256-cg6eojqDcJQ6l5ATAWUhFeJi+WnPPgNYV2Ggg+0NAkc=' 'sha256-e23SgYYz6PmmBNsag5O/bllarTwbAlqPcpHLNDuwcJA=' 'sha256-eElepNhwMvvfCjchYRv4kRz2yAJ1Mdu2Rc5r0x+pLl0=' 'sha256-ee4qj7PmWdicS1+8BfoZ7gKUmUkNk9fCPvLK3CwGE18=' 'sha256-eoZKPPj7R1opAA3EaZUGTmO56gm1hhyiyo8phdpFl9c=' 'sha256-gHiFvULFIsXf5hUshwpKF11tDkvGBPOvfyc29G6vP1A=' 'sha256-h3MviqQvY0Uwcgm9pQwXNx2B0853JumxOwz+7mBrC9w=' 'sha256-ifPtde5wXsLugO5t9IqZOGJUJMDQhWM+R63RDPpO6uA=' 'sha256-kXpoXvVKnbNbejcmUwSi5fXWdBoDnLxOqWaOJyCrMzU=' 'sha256-l/PdTy5HWMe1nzt7m5liItsDDozCwJs4PXnNtMfVw8Q=' 'sha256-lACe5Z6lV8M72Ishex7GHpBbGCKsWl8442uFL1FcLpk=' 'sha256-lF+ti2jwAVkclmfUfadvnIPEVg5xCxth9S+VP6+XGqw=' 'sha256-mp6lyUlmS9p/vWjep6wkQJYFgohVN7+KFcLvsnyQgIY=' 'sha256-qDWB71RYIA02Hd/sFOMLdLZJXtDS5WYQ0qQGy05T3q8=' 'sha256-rTnvwyEFfGjMtMjqFhPSoPT5GhRrs0caAIn3u0DXdFo=' 'sha256-sSMqNNAauNnTk/pd1iPIz5clmGc4R5IA5LE9lnMFJK4=' 'sha256-sdwyZHRqE+fhQNLHz15izJXmyapmsIaxKnbX3exyeZQ=' 'sha256-sj9OxUfexeVaFJ5h8exUlStC2/Q1Ff+U6ckR3wr176E=' 'sha256-ssEUflZoKdkHVfmZG5RO7NCLh3qHJC0nomBEARWO7HE=' 'sha256-tjlTzCw8mOcG8HZeEhgJJg/GEokwcRIfkRLKCmpRfyI=' 'sha256-tnarDbcNMMtz825gTMjDdXkgs/v0csmXAprV7tx4m4s=' 'sha256-uH8MtSiF/h0fM04cWoSyV2KPDwS69cYz6TA0ylq6yEM=' 'sha256-vMipR6Pj+J1+uzPBaR4tLBFZWq18gxHQrsF4Yl9osVQ=' 'sha256-vbjnumaGfnX0chgJjnlz2mHY4K4YSldoiIN5tMpsJ8w=' 'sha256-wBcOJ/YnBvIVcoHaS1Hof0u/IrpkD4IR2zSxMB3DD1k=' 'sha256-xh7CUIAeDEyuZ439ct3hPfIQiNb6U+VN/0//lRZ6kZg=' 'sha256-y5946ax0zdTuGeSBkocmo9arRgmzaRYbXj2yKsByGmc=' 'sha256-yUOkJaqPNIZARyYqMlDbRGTCmZ/C+wMChomy6GJP3QI=' 'sha256-z+kbhAfYnais1UUyDCDwulWuXH8+RLiV94ugXlzKRl8='; script-src-attr 'none'; style-src 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: https://overkillhill.com https://*.github.io https://avatars.githubusercontent.com https://www.googletagmanager.com; connect-src 'self' https://www.google-analytics.com https://*.google-analytics.com https://www.googletagmanager.com https://okhp3.github.io; media-src 'self' https://okhp3.github.io/murderbird-uncaged/audio/iron-verdict-v3/full-song.mp3; frame-src 'self' https://okhp3.github.io; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; manifest-src 'self'; upgrade-insecure-requests; report-uri /__csp-report

# Long-cache hashed assets — once cache_bust.py is wired into deploy, every
# stylesheet/script ref will carry a content-hash ?v=, so the underlying file
# is safe to serve with immutable caching.
/assets/css/*
  Cache-Control: public, max-age=31536000, immutable

/assets/js/*
  Cache-Control: public, max-age=31536000, immutable

/assets/img/*
  Cache-Control: public, max-age=31536000, immutable
  # Static images may be referenced cross-origin (LinkedIn / Twitter share cards
  # crawl our og:image URLs). Override the page-wide CORP same-origin to cross-origin
  # for image assets only.
  Cross-Origin-Resource-Policy: cross-origin

# Search index — must NOT be cached immutably; rebuilt on every content change.
# More-specific rule, declared after /assets/* so it wins on this exact path.
/assets/data/search-index.json
  Cache-Control: public, max-age=300, must-revalidate

/assets/img/favicons/*
  Cache-Control: public, max-age=604800

# HTML — short cache, must revalidate so eyebrow/copy fixes propagate fast.
/*.html
  Cache-Control: public, max-age=300, must-revalidate

# Directory-index routes are emitted as HTML by the static host even though
# their public URLs do not end in .html.
/*/
  Cache-Control: public, max-age=300, must-revalidate

/
  Cache-Control: public, max-age=300, must-revalidate

# Generated route inventory. Keep this revalidating so new pages reach crawlers
# without waiting for a long-lived edge cache.
/sitemap.xml
  Cache-Control: public, max-age=300, must-revalidate