cesnimda
9088dcffb9
- site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
10 lines
284 B
Plaintext
10 lines
284 B
Plaintext
---
|
|
/*
|
|
No-flash theme init. Loaded as an external, render-blocking script (served from
|
|
/theme-init.js) so a strict CSP can allow script-src 'self' without inline hashes.
|
|
Runs before first paint. See public/theme-init.js.
|
|
*/
|
|
---
|
|
|
|
<script is:inline src="/theme-init.js"></script>
|