diff --git a/nginx/nginx.conf b/nginx/nginx.conf index 260bc0ab..e39500de 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -81,7 +81,7 @@ http { aio_write on; map $uri $preload_resources_uri { - /index.html ", ; rel=preload; as=image, <{{path|/js/redirect.js}}>; rel=modulepreload; integrity={{integrity|/js/redirect.js}}"; + /index.html ", <{{path|/pixel-7-pro.svg}}>; rel=preload; as=image, <{{path|/js/redirect.js}}>; rel=modulepreload; integrity={{integrity|/js/redirect.js}}"; /faq.html ", <{{path|/js/redirect.js}}>; rel=modulepreload; integrity={{integrity|/js/redirect.js}}"; /install/index.html ", <{{path|/js/redirect.js}}>; rel=modulepreload; integrity={{integrity|/js/redirect.js}}"; /install/cli.html ", <{{path|/js/redirect.js}}>; rel=modulepreload; integrity={{integrity|/js/redirect.js}}"; @@ -116,7 +116,7 @@ http { } map $nopush $push_phone { - 0 /phone.png; + 0 "{{path|/pixel-7-pro.svg}}"; } map $nopush $push_redirect_js { @@ -322,12 +322,6 @@ http { add_header Cache-Control "public, max-age=604800"; } - location = {{path|/mask-icon.svg}} { - include snippets/security-headers.conf; - add_header Cross-Origin-Resource-Policy "same-origin" always; - add_header Cache-Control "public, max-age=31536000, immutable"; - } - location = /.well-known/matrix/client { include snippets/security-headers.conf; add_header Cross-Origin-Resource-Policy "cross-origin" always; @@ -448,6 +442,12 @@ http { add_header Cache-Control "public, max-age=604800"; } + location ~ "\.svg$" { + include snippets/security-headers.conf; + add_header Cross-Origin-Resource-Policy "same-origin" always; + add_header Cache-Control "public, max-age=31536000, immutable"; + } + location ~ "\.png$" { include snippets/security-headers.conf; # avoid breaking image hotlinking such as https://github.com/TryGhost/Ghost/issues/12880 diff --git a/process-static b/process-static index db095b49..7ac4e9fe 100755 --- a/process-static +++ b/process-static @@ -43,7 +43,7 @@ eslint static-tmp/**/!(fastboot.min.m|z-worker-pako.|pako_inflate.min.|)js find static-tmp -name '*.js' -exec terser --ecma 2021 --module -cmo {} {} \; replace= -for file in static-tmp/**/*.css static-tmp/js/*.js static-tmp/mask-icon.svg; do +for file in static-tmp/**/*.css static-tmp/js/*.js static-tmp/**/!(bimi|favicon).svg; do hash=$(sha256sum "$file" | head -c 8) sri_hash=sha256-$(openssl dgst -sha256 -binary "$file" | openssl base64 -A) dest="$(dirname $file)/$hash.$(basename $file)" diff --git a/static/index.html b/static/index.html index 2ae061da..f44a9f9e 100644 --- a/static/index.html +++ b/static/index.html @@ -59,7 +59,7 @@
- +
diff --git a/static/phone.png b/static/phone.png deleted file mode 100644 index 7fcf1fa1..00000000 Binary files a/static/phone.png and /dev/null differ diff --git a/static/pixel-7-pro.svg b/static/pixel-7-pro.svg new file mode 100644 index 00000000..11cae528 --- /dev/null +++ b/static/pixel-7-pro.svg @@ -0,0 +1 @@ + \ No newline at end of file