netlify.toml

# Settings in the [build] context are global and are applied to all contexts
# unless otherwise overridden by more specific contexts.
[build]
  # Directory to change to before starting a build.
  # This is where we will look for package.json/.nvmrc/etc.
  base = ""

  # Default build command.
  command = "sphinx-build -b html source build"

  # Directory (relative to root of your repo) that contains the deploy-ready
  # HTML files and assets generated by the build. If a base directory has
  # been specified, include it in the publish directory path.
  publish = "build"

[context.production]
  # Production content is pushed to master
  # Exit code 0 means that this build will be ignored
  # https://docs.netlify.com/configure-builds/file-based-configuration/#ignore-builds
  ignore = "true"

[[headers]]
  for = "/*"
  [headers.values]
    # Only allow resources to be loaded from the current origin. Styles make
    # also specified inline, and unsafe inline JS script blocks are allowed
    # because it's needed for RTD theme navigation and the search function:
    # https://github.com/readthedocs/sphinx_rtd_theme/issues/817
    # We also allow loading MathJax, which is needed to render math formulas.
    Content-Security-Policy = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' https://cdn.jsdelivr.net/npm/mathjax@3/ 'unsafe-inline'; font-src 'self' https://cdn.jsdelivr.net/npm/mathjax@3/"

    # Disable all browser features that we don't need. Unfortunately
    # there is no way to specify a default for all directives yet, so
    # the list is very long.
    # See this for details:
    # https://github.com/w3c/webappsec-permissions-policy/issues/189
    Permissions-Policy = "ambient-light-sensor=(); autoplay=(); accelerometer=(); camera=(); display-capture=(); document-domain=(); encrypted-media=(); fullscreen=(); gyroscope=(); magnetometer=(); microphone=(); midi=(); payment=(); picture-in-picture=(); sync-xhr=(); usb=(); wake-lock=(); xr-spatial-tracking=()"

    # Don't send the Referrer header over insecure connections (when
    # linking to HTTP sites)
    Referrer-Policy = "no-referrer-when-downgrade"

    # Disable mime-type sniffing (probably not relevant without user
    # uploads,but doesn't hurt either)
    X-Content-Type-Options = "nosniff"

    # Prohibit framing to prevent clickjacking attacks
    X-Frame-Options = "DENY"

    # Stop page from loading if a reflected XSS attack is detected
    X-XSS-Protection = "1; mode=block"