[build]
  publish = 'public'
  command = 'hugo --source=exampleSite --gc --verbose --minify --destination ../public'

[context.production.environment]
  HUGO_VERSION = '0.101.0'
  HUGO_ENV = 'production'
  HUGO_ENABLEGITINFO = 'true'
  HUGO_GOOGLEANALYTICS = 'G-DP9Q137C3X'

[context.split1]
  command = 'hugo --source=exampleSite --gc --minify --enableGitInfo --destination ../public'

[context.split1.environment]
  HUGO_VERSION = '0.101.0'
  HUGO_ENV = 'production'

[context.deploy-preview]
  command = 'hugo --source=exampleSite --gc --minify --buildDrafts --buildFuture --baseURL $DEPLOY_PRIME_URL --destination ../public'

[context.deploy-preview.environment]
  HUGO_VERSION = '0.101.0'

[context.branch-deploy]
  command = 'hugo --source=exampleSite --gc --minify --baseURL $DEPLOY_PRIME_URL --destination ../public'

[context.branch-deploy.environment]
  HUGO_VERSION = '0.101.0'

[context.next.environment]
  HUGO_ENABLEGITINFO = 'true'

# There are a basic set of standard security headers that every
# website should set to help make your website more secure.
[[headers]]
  for = "/*"
  [headers.values]
    # This sets whether you want your website to be in a frame or not.
    # Most of the time you don’t, as it can open up a website to clickjacking.
    X-Frame-Options = "DENY"
    # In older browsers and mainly Safari, this stops pages loading
    # when they detect reflected cross-site scripting attacks.
    X-XSS-Protection = "1; mode=block"
    # Used to stop browser from sniffing and changing MIME content type.
    X-Content-Type-Options = "nosniff"
    # This controls how much referrer information is included with
    # requests.
    Referrer-Policy = "same-origin"
    # Inform browsers that the site should only be accessed using HTTPS,
    # and that any future attempts to access it using HTTP should automatically
    # be converted to HTTPS.
    #
    # includeSubDomains - If this optional parameter is specified, this rule
    #                     applies to all of the site's subdomains as well.
    #
    # preload - If this optional parameter is specified, the browser will
    #           send a preload request to the server for the HTTPS version
    #           of the resource as soon as the user switches to the HTTPS
    #           version of the page.
    Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"
    # This used to be called Feature Policy and is mainly only support by
    # Chrome browsers. It’s used to control what browser APIs can be used.
    Permissions-Policy = "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()"
    # CSP makes it possible for server administrators to reduce or eliminate
    # the vectors by which XSS can occur by specifying the domains that the
    # browser should consider to be valid sources of executable scripts.
    # A CSP compatible browser will then only execute scripts loaded in source
    # files received from those allowed domains, ignoring all other scripts
    # (including inline scripts and event-handling HTML attributes).
    #
    Content-Security-Policy = "base-uri 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'self'; media-src 'self'; worker-src 'self'; img-src 'self' data: *.google-analytics.com *.googletagmanager.com; script-src 'self' *.netlify.app *.netlify.com *.googletagmanager.com; form-action 'self' submit-form.com; frame-ancestors 'none'; manifest-src 'self'; connect-src 'self' *.google-analytics.com *.analytics.google.com *.googletagmanager.com; report-uri https://4908d40959a9f3d63d9095d1afd87166.report-uri.com/r/d/csp/enforce"

[[headers]]
  for = '/feeds/*.xml'
  [headers.values]
    # The correct header Content-Type header for an Atom feed is
    # application/atom+xml. However, Chromium does not handle it
    # correctly (see https://code.google.com/p/chromium/issues/detail?id=104358).
    #
    # The most compatible header is 'text/xml; charset=utf-8', which
    # will cause the feed to be parsed correctly by most clients.
    # Note that you should be encoding your feed in UTF-8.
    Content-Type = 'text/xml; charset=utf-8'

[[headers]]
  for = '/*/feeds/*.xml'
  [headers.values]
    # The same reason as above applies to Atom feeds.
    Content-Type = 'text/xml; charset=utf-8'

[[headers]]
  for = '/feeds/*.json'
  [headers.values]
    # JSON Feed files should be served using the MIME type application/json
    # and should be encoded using UTF-8.
    Content-Type = 'application/feed+json; charset=utf-8'

[[headers]]
  for = '/*/feeds/*.json'
  [headers.values]
    Content-Type = 'application/feed+json; charset=utf-8'

[[headers]]
  for = '/manifest.webmanifest'
  [headers.values]
    # The .webmanifest extension is specified in the Media type registration
    # section of the specification (the response of the manifest file should
    # return Content-Type: application/manifest+json).
    #
    # For more see: https://w3c.github.io/manifest/#media-type-registration=
    Content-Type = 'application/manifest+json; charset=utf-8'

[[headers]]
  for = '/robots.txt'
  [headers.values]
    # The server’s robots.txt file must be saved as plain text with
    # ASCII character encoding.
    Content-Type = 'text/plain; charset=us-ascii'