feat: Docker images, compose stacks, nginx config, Gitea CI

- site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-04 06:21:35 +02:00
parent 033c9ec315
commit 9088dcffb9
11 changed files with 322 additions and 20 deletions
@@ -0,0 +1,18 @@
+/*
+  No-flash theme init (external so a strict CSP can use script-src 'self' with no
+  inline hash). Loaded render-blocking in <head>, runs before first paint: marks
+  that JS is available (reveal animations are gated behind html.js) and applies the
+  stored or system theme. First visit follows the system; once set, the choice persists.
+*/
+(function () {
+  document.documentElement.classList.add('js');
+  try {
+    var t = localStorage.getItem('theme');
+    if (t !== 'light' && t !== 'dark') {
+      t = window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark';
+    }
+    document.documentElement.dataset.theme = t;
+  } catch (e) {
+    document.documentElement.dataset.theme = 'dark';
+  }
+})();