simlin/app.yaml at main · bpowers/simlin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
runtime: nodejs24

build_env_variables:
  GOOGLE_NODE_RUN_SCRIPTS: ''

instance_class: F4
automatic_scaling:
  max_concurrent_requests: 100
  # Cost cap: bounds worst-case fan-out if a render storm or crash loop drives
  # autoscaling (issue #694). 8 F4 instances is far above routine load; raise
  # deliberately if organic traffic ever needs it. Mirror this into
  # .app.prod.yaml -- scripts/validate-app-prod-config.mjs enforces it there.
  max_instances: 8

handlers:
- url: /static
  static_dir: public/static
  secure: always
  http_headers:
    # The embeddable web component (sd-component.js) is hotlinked from
    # third-party origins (issue #688); its engine worker's WASM fetch (and
    # any @font-face/CSS asset loads) are cross-origin CORS requests against
    # these assets. They are public, immutable, content-hashed files served
    # without credentials, so a wildcard origin is appropriate and adds no
    # risk. Mirror this into .app.prod.yaml --
    # scripts/validate-app-prod-config.mjs enforces it there.
    Access-Control-Allow-Origin: "*"

- url: /$
  static_files: public/index.html
  upload: public/index.html
  secure: always
  http_headers:
    Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
    Content-Security-Policy: "default-src 'self'; frame-src 'self' https://simlin.firebaseapp.com https://auth.simlin.com; base-uri 'self'; block-all-mixed-content; connect-src 'self' https://www.googleapis.com https://securetoken.googleapis.com https://identitytoolkit.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; frame-ancestors 'self'; img-src 'self' data: blob: https://*.googleusercontent.com https://www.gstatic.com; object-src 'none'; script-src 'self' blob: 'unsafe-eval' https://apis.google.com; script-src-attr 'none'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; upgrade-insecure-requests"

- url: /new$
  static_files: public/index.html
  upload: public/index.html
  secure: always
  http_headers:
    Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
    Content-Security-Policy: "default-src 'self'; frame-src 'self' https://simlin.firebaseapp.com https://auth.simlin.com; base-uri 'self'; block-all-mixed-content; connect-src 'self' https://www.googleapis.com https://securetoken.googleapis.com https://identitytoolkit.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; frame-ancestors 'self'; img-src 'self' data: blob: https://*.googleusercontent.com https://www.gstatic.com; object-src 'none'; script-src 'self' blob: 'unsafe-eval' https://apis.google.com; script-src-attr 'none'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; upgrade-insecure-requests"

- url: /(legal|legal/cookies|privacy)$
  static_files: public/\1/index.html
  upload: public/(legal|legal/cookies|privacy)/index.html
  secure: always

- url: /(robots|ads)\.txt$
  static_files: public/\1.txt
  upload: public/(robots|ads)\.txt
  secure: always

- url: /(favicon.ico(.png)?)$
  static_files: public/\1
  upload: public/(favicon.ico(.png)?)
  secure: always

- url: /manifest.json$
  static_files: public/manifest.json
  upload: public/manifest.json
  secure: always

- url: /.*
  secure: always
  redirect_http_response_code: 301
  script: auto