cesnimda
9088dcffb9
- site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
19 lines
719 B
JavaScript
19 lines
719 B
JavaScript
/*
|
|
No-flash theme init (external so a strict CSP can use script-src 'self' with no
|
|
inline hash). Loaded render-blocking in <head>, runs before first paint: marks
|
|
that JS is available (reveal animations are gated behind html.js) and applies the
|
|
stored or system theme. First visit follows the system; once set, the choice persists.
|
|
*/
|
|
(function () {
|
|
document.documentElement.classList.add('js');
|
|
try {
|
|
var t = localStorage.getItem('theme');
|
|
if (t !== 'light' && t !== 'dark') {
|
|
t = window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark';
|
|
}
|
|
document.documentElement.dataset.theme = t;
|
|
} catch (e) {
|
|
document.documentElement.dataset.theme = 'dark';
|
|
}
|
|
})();
|