From fe864f29c0938b495c78d6aacb51a443115cf1aa Mon Sep 17 00:00:00 2001 From: Amr Gaber Date: Sun, 14 Jun 2026 14:53:15 -0500 Subject: [PATCH] Add netlify.toml for build, SPA routing, headers, and prod env Codify Netlify config in-repo instead of the dashboard: - pnpm build / publish dist, Node 24 / pnpm 10 - production VITE_API_URL + VITE_GHOST_URL (non-secret); Ghost Content key stays a Netlify env var - SPA fallback redirect (consolidated from public/_redirects, now removed) - baseline security headers (X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, HSTS) --- netlify.toml | 33 +++++++++++++++++++++++++++++++++ public/_redirects | 1 - 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 netlify.toml delete mode 100644 public/_redirects diff --git a/netlify.toml b/netlify.toml new file mode 100644 index 0000000..fb25a26 --- /dev/null +++ b/netlify.toml @@ -0,0 +1,33 @@ +# Netlify configuration for treepolitics-web. +# Build settings, SPA routing, security headers, and non-secret build-time env +# vars live here (single source of truth) rather than in the Netlify dashboard. + +[build] + command = "pnpm build" + publish = "dist" + +[build.environment] + NODE_VERSION = "24" + PNPM_VERSION = "10" + +# Public, non-secret build-time config. The Ghost Content API key is injected as +# a Netlify environment variable (VITE_GHOST_CONTENT_KEY) so it stays out of git. +[context.production.environment] + VITE_API_URL = "https://api.treepolitics.net" + VITE_GHOST_URL = "https://content.treepolitics.net" + +# SPA fallback: serve index.html for any path so client-side routing works. +[[redirects]] + from = "/*" + to = "/index.html" + status = 200 + +# Baseline security headers for all responses. +[[headers]] + for = "/*" + [headers.values] + X-Frame-Options = "DENY" + X-Content-Type-Options = "nosniff" + Referrer-Policy = "strict-origin-when-cross-origin" + Permissions-Policy = "geolocation=(), microphone=(), camera=()" + Strict-Transport-Security = "max-age=31536000" diff --git a/public/_redirects b/public/_redirects deleted file mode 100644 index ad37e2c..0000000 --- a/public/_redirects +++ /dev/null @@ -1 +0,0 @@ -/* /index.html 200