netlify.toml

# Global settings applied to the whole site.
[build]
  publish = "public"
  command = "hugo"

[context.production.environment]
  HUGO_ENV = "production"

[context.deploy-preview]
  command = "hugo --baseURL $DEPLOY_PRIME_URL"
#  --buildDrafts --buildFuture might be useful one day?

# Branch Deploy context: All deploys that are not in
# an active Deploy Preview will inherit these settings.
[context.branch-deploy]
  command = "hugo --baseURL $DEPLOY_PRIME_URL"

[[headers]]
  for = "/*"
  [headers.values]
  Content-Security-Policy = "default-src 'none'; script-src 'self' 'unsafe-inline' https://matomo.kee.pm/js/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'sha256-ovn02t217b3OZUKwAyK+y5bStjN4Yu74vJncEhtWfkM=' 'sha256-ZCy+flNfu2bIXvkaizdUX6xGPkKGWzizBIMDlR+z4jo=' 'sha256-3JwQL3po/nchVImV+zo3jKO8egUoWVcAjb2s03D4vRU=' 'sha256-hDq39Y+nbgxwJTQLH+KSudjHcxs0mdYvIYcN61WOl6Q='; connect-src 'self' https://matomo.kee.pm/js/ https://id.kee.pm/deleteAccountStart; img-src 'self' data: https://matomo.kee.pm/js/ https://d33wubrfki0l68.cloudfront.net; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-ancestors 'none'; child-src https://rid.kee.pm/; frame-src https://rid.kee.pm/ https://www.google.com/; report-uri https://keevault.report-uri.com/r/d/csp/enforce;"
  X-Frame-Options = "DENY"
  X-Content-Type-Options = "nosniff"
  X-Xss-Protection = "1; mode=block; report=https://keevault.report-uri.com/r/d/xss/enforce"
  Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"