updated hugo config to distinguish between development and production

config.toml → config/_default/hugo.toml

@@ -111,11 +111,3 @@ block = true
 
 [permalinks]
   blog = "/blog/:year/:month/:day/:slug/"
-
-[server]
-  [[server.headers]]
-      for = '/**'
-      [server.headers.values]
-        Content-Security-Policy = "default-src 'none'; script-src 'self' 'unsafe-eval' https://community.cryptomator.org/ https://js.stripe.com/ https://*.paddle.com/ https://www.google.com/ https://www.gstatic.com/; style-src 'self' 'unsafe-inline' https://*.paddle.com/; img-src 'self' data: https://static.cryptomator.org/ https://i.ytimg.com/ https://*.paddle.com/ https://paddle.s3.amazonaws.com/; connect-src 'self' https://api.cryptomator.org/ https://store.cryptomator.org/ http://localhost:8787/; font-src 'self'; media-src https://static.cryptomator.org/; frame-src https://community.cryptomator.org/ https://www.youtube-nocookie.com/ https://js.stripe.com/ https://*.paddle.com/ https://www.google.com/; base-uri 'self'; form-action 'self' https://www.paypal.com/ https://www.coinpayments.net/; frame-ancestors 'none'; upgrade-insecure-requests"
-        Strict-Transport-Security = "max-age=31536000; includeSubDomains"
-        X-Content-Type-Options = "nosniff"

config/development/server.toml

@@ -0,0 +1,7 @@
+[server]
+  [[server.headers]]
+      for = '/**'
+      [server.headers.values]
+        Content-Security-Policy = "default-src 'none'; script-src 'self' 'unsafe-eval' https://community.cryptomator.org/ https://js.stripe.com/ https://*.paddle.com/ https://www.google.com/ https://www.gstatic.com/; style-src 'self' 'unsafe-inline' https://*.paddle.com/; img-src 'self' data: https://static.cryptomator.org/ https://i.ytimg.com/ https://*.paddle.com/ https://paddle.s3.amazonaws.com/; connect-src 'self' https://api.cryptomator.org/ https://store.cryptomator.org/ http://localhost:8787/; font-src 'self'; media-src https://static.cryptomator.org/; frame-src https://community.cryptomator.org/ https://www.youtube-nocookie.com/ https://js.stripe.com/ https://*.paddle.com/ https://www.google.com/; base-uri 'self'; form-action 'self' https://www.paypal.com/ https://www.coinpayments.net/; frame-ancestors 'none'"
+        Strict-Transport-Security = "max-age=31536000; includeSubDomains"
+        X-Content-Type-Options = "nosniff"

config/production/server.toml

@@ -0,0 +1,7 @@
+[server]
+  [[server.headers]]
+      for = '/**'
+      [server.headers.values]
+        Content-Security-Policy = "default-src 'none'; script-src 'self' 'unsafe-eval' https://community.cryptomator.org/ https://js.stripe.com/ https://*.paddle.com/ https://www.google.com/ https://www.gstatic.com/; style-src 'self' 'unsafe-inline' https://*.paddle.com/; img-src 'self' data: https://static.cryptomator.org/ https://i.ytimg.com/ https://*.paddle.com/ https://paddle.s3.amazonaws.com/; connect-src 'self' https://api.cryptomator.org/ https://store.cryptomator.org/; font-src 'self'; media-src https://static.cryptomator.org/; frame-src https://community.cryptomator.org/ https://www.youtube-nocookie.com/ https://js.stripe.com/ https://*.paddle.com/ https://www.google.com/; base-uri 'self'; form-action 'self' https://www.paypal.com/ https://www.coinpayments.net/; frame-ancestors 'none'; upgrade-insecure-requests"
+        Strict-Transport-Security = "max-age=31536000; includeSubDomains"
+        X-Content-Type-Options = "nosniff"

package.json

@@ -5,7 +5,7 @@
   "scripts": {
     "clean": "rm -r public",
     "build": "hugo",
-    "serve": "HUGO_ENV=development hugo server",
+    "serve": "hugo server",
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "author": "Sebastian Stenzel",