;;; Tyreunom's system administration and configuration tools.

;;;

;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>

;;;

;;; This program is free software: you can redistribute it and/or modify

;;; it under the terms of the GNU General Public License as published by

;;; the Free Software Foundation, either version 3 of the License, or

;;; (at your option) any later version.

;;;

;;; This program is distributed in the hope that it will be useful,

;;; but WITHOUT ANY WARRANTY; without even the implied warranty of

;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

;;; GNU General Public License for more details.

;;;

;;; You should have received a copy of the GNU General Public License

;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

(define-module (config web)

  #:export (web-base-policy

            web-html-policy

	    default-web-policy))

(define web-base-policy

  '("add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"

    "add_header X-Frame-Options DENY;"

    "add_header X-Content-Type-Options nosniff;"

    "add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"

    "add_header Referrer-Policy no-referrer;"))

(define (web-html-policy additional-data)

  (append

    '("location ~ \\.html$ {"

      "    add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';"

      "    add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"

      "    add_header X-Frame-Options DENY;"

      "    add_header X-Content-Type-Options nosniff;"

      "    add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"

      "    add_header Referrer-Policy no-referrer;")

    additional-data

    '("    expires off;"

      "}")))

(define default-web-policy

  (append

    web-base-policy

    (web-html-policy '())))