_headers

# Cache policy, and the reason there is a file for it at all.
#
# Keraunos and Tyche are built by Vite, which fingerprints every asset, so their
# filenames change whenever their contents do and the browser can be told to
# hold them forever without ever going stale. This project has no build step on
# purpose — the page's claim is that it shows its working, and a reader can open
# devtools on the deployed site and read the same `tests.js` that grades the
# stream, comments and all. The cost of that is stable filenames, which is
# exactly the case where a browser can be left running last week's code.
#
# So the policy is set by hand instead. Nothing here is a performance tweak;
# every line is about which of two failure modes a given file can afford.
#
# The policy below is the creed enforced rather than promised. `default-src
# 'none'` denies every fetch this page could make, and this instrument reaches
# exactly one thing that is not itself: the relay, which is the same one
# Keraunos drinks from and the same URL the `feed` meta tag carries. There is no
# other request on the page.
#
# The `?feed=wss://…` override still works in development, which is served
# without these headers; on the deployed site it is refused, and that is the
# right way round for a relay somebody else pays for.
#
# The hash is of the medium script in the head, which is inline because it has
# to run before first paint and cannot afford a round trip. Edit that script and
# recompute:
#   python3 -c "import re,hashlib,base64;s=re.search(r'<script>(.*?)</script>',open('index.html').read(),re.S).group(1);print(base64.b64encode(hashlib.sha256(s.encode()).digest()).decode())"

/*
  Content-Security-Policy: default-src 'none'; script-src 'self' 'sha256-jMnoz/9oZu0F0vd1uz9K6VJ6hDWSqWYMhWNsW4lqk+w='; style-src 'self'; font-src 'self'; img-src 'self'; connect-src wss://keraunos-relay.covardt.workers.dev; base-uri 'none'; form-action 'none'; frame-ancestors 'none'
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin

# The typeface. A given weight and subset of a released face does not change, so
# this is the one thing safe to hold indefinitely, and it is also the heaviest
# thing on the page — 30KB of the two latin files against 23KB for the whole of
# the gzipped source. If a face is ever swapped, rename the file rather than
# editing it in place; that is what makes this line true.
/fonts/*
  Cache-Control: public, max-age=31536000, immutable

# The source, under names that never change. Revalidated on every visit: the
# request costs a round trip and a 304, and the alternative is a returning
# reader running a stale copy of the tests while the badges claim otherwise,
# which is the one kind of wrong this page cannot be.
/src/*
  Cache-Control: public, max-age=0, must-revalidate

/crt.css
  Cache-Control: public, max-age=0, must-revalidate

# The document, which carries the relay's address in a meta tag. Held, it would
# pin a reader to a relay that has since moved, and the symptom would be a bezel
# stuck on `[ linking ]` with nothing to say why.
/
  Cache-Control: public, max-age=0, must-revalidate

/index.html
  Cache-Control: public, max-age=0, must-revalidate