render.yaml

services:
  - type: web
    name: tfa-backup-encoder
    env: static
    buildCommand: cd encoder && npm install && npm run build
    staticPublishPath: ./encoder/dist
    # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
    # Ignoring `Access-Control-Allow-Origin` to allow for self-hosting.
    headers:
      - &x_frame_options
        path: //
        name: X-Frame-Options
        value: DENY
      - &referrer_policy
        path: //
        name: Referrer-Policy
        value: strict-origin-when-cross-origin
      - &x_content_type_options
        path: /*
        name: X-Content-Type-Options
        value: nosniff
      - &content_type_html
        path: //
        name: Content-Type
        value: text/html; charset=UTF-8
      - &content_type_css
        path: /css/*.css
        name: Content-Type
        value: text/css
      - &content_type_js
        path: /js/*.js
        name: Content-Type
        value: text/javascript
      - &content_type_png
        path: /*.png
        name: Content-Type
        value: image/png
      - &content_type_woff
        path: /fonts/*.woff
        name: Content-Type
        value: font/woff
      - &content_type_woff2
        path: /fonts/*.woff2
        name: Content-Type
        value: font/woff2
      - &strict_transport_security
        path: //
        name: Strict-Transport-Security
        value: max-age=63072000; includeSubDomains; preload
      - &cross_origin_opener_policy
        path: //
        name: Cross-Origin-Opener-Policy
        value: same-origin
      - &cross_origin_resource_policy
        path: //
        name: Cross-Origin-Resource-Policy
        value: same-site
      - &cross_origin_embedder_policy
        path: //
        name: Cross-Origin-Embedder-Policy
        value: require-corp
      - &permissions_policy
        path: //
        name: Permissions-Policy
        value: interest-cohort=()
      - path: //
        name: Content-Security-Policy
        # `style-src 'unsafe-inline'`: To allow for built-in browser styles in PDF's `<iframe>`.
        # `font-src data:`: See https://security.stackexchange.com/a/95011 for considerations.
        # `img-src data:`: For https://github.com/soldair/node-qrcode#todataurltext-options-cberror-url-1.
        # `frame-src blob:`: For https://github.com/crabbly/Print.js/blob/6502c73c7e1ba87346fe4913fa5de6220936095b/src/js/pdf.js#L53-L54.
        value: >
          base-uri 'none';
          form-action 'none';
          frame-ancestors 'none';
          default-src 'none';
          script-src 'self';
          style-src 'self' 'unsafe-inline';
          font-src 'self' data:;
          img-src 'self' data:;
          frame-src blob:
  - type: web
    name: tfa-backup-splitter
    env: static
    buildCommand: cd splitter && npm install && npm run build
    staticPublishPath: ./splitter/dist
    # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
    # Ignoring `Access-Control-Allow-Origin` to allow for self-hosting.
    headers:
      - *x_frame_options
      - *referrer_policy
      - *x_content_type_options
      - *content_type_html
      - *content_type_css
      - *content_type_js
      - *content_type_png
      - *content_type_woff
      - *content_type_woff2
      - *strict_transport_security
      - *cross_origin_opener_policy
      - *cross_origin_resource_policy
      - *cross_origin_embedder_policy
      - *permissions_policy
      - path: //
        name: Content-Security-Policy
        # `style-src 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='`: `vuetify.Theme.genStyleElement`.
        # `style-src 'sha256-H0hALk5rjM4aGisbF9hx4t4yVUsKf0ZX1N28nouwAhI='`: `vuetify.Theme.css`.
        # `font-src data:`: See https://security.stackexchange.com/a/95011 for considerations.
        value: >
          base-uri 'none';
          form-action 'none';
          frame-ancestors 'none';
          default-src 'none';
          script-src 'self';
          style-src 'self' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-H0hALk5rjM4aGisbF9hx4t4yVUsKf0ZX1N28nouwAhI=';
          font-src 'self' data:;
          img-src 'self'