app.yaml

runtime: nodejs20
default_expiration: 2m

handlers:

- url: /(.*\.(css|eot|gz|ico|jpg|jpeg|js|json|map|png|svg|otf|ttf|woff|woff2))
  static_files: build/\1
  upload: build/.*\.(css|eot|gz|ico|jpg|jpeg|js|json|map|png|svg|otf|ttf|woff|woff2)
  secure: always
  http_headers:
    X-Content-Type-Options: "nosniff"

- url: /(google.*\.html)
  mime_type: text/html
  static_files: build/\1
  upload: build/(google.*\.html)
  secure: always
  http_headers:
    X-Content-Type-Options: "nosniff"

- url: /.*
  static_files: build/index.html
  upload: build/index.html
  expiration: 0s
  secure: always
  http_headers:
    Content-Security-Policy: "base-uri 'self'; object-src 'none'; script-src 'self' 'unsafe-eval' https://fast.appcues.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; style-src * 'unsafe-inline'"
    X-Frame-Options: "SAMEORIGIN"
    Strict-Transport-Security: "max-age=31536000; includeSubdomains; preload"
    X-Content-Type-Options: "nosniff"
    X-XSS-Protection: "1; mode=block"