feat: dynamically created _headers

Author: stradichenko

config/_default/hugo.toml

@@ -413,11 +413,25 @@ enableRobotsTXT = true
     root = false
     ugly = false
     weight = 0
+  [outputFormats.headers]
+    baseName = '_headers'
+    isHTML = false
+    isPlainText = true
+    mediaType = 'text/plain'
+    noUgly = false
+    notAlternative = true
+    path = ''
+    permalinkable = false
+    protocol = ''
+    rel = 'alternate'
+    root = true
+    ugly = false
+    weight = 0
 
 [outputs]
   # JSON output is required for search functionality
   # The search index (/index.json) includes only pages from sections defined in params.taxonomies.mainSections
-  home = ['HTML', 'RSS', 'JSON']  # Ensure JSON is included for search
+  home = ['HTML', 'RSS', 'JSON', 'headers']
   page = ['HTML', 'JSON'] # needed for portfolio.json
   rss = ['RSS']
   section = ['HTML', 'RSS', 'JSON']

layouts/_default/headers.txt

@@ -0,0 +1,9 @@
+/*
+  # Content Security Policy to allow Matomo analytics
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' {{ .Site.BaseURL | strings.TrimSuffix "/" }}/analytics http://localhost:8080; connect-src 'self' {{ .Site.BaseURL | strings.TrimSuffix "/" }}/analytics http://localhost:8080; img-src 'self' data: {{ .Site.BaseURL | strings.TrimSuffix "/" }}/analytics http://localhost:8080; style-src 'self' 'unsafe-inline'; font-src 'self' data:
+  
+  # Security headers
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  X-XSS-Protection: 1; mode=block
+  Referrer-Policy: strict-origin-when-cross-origin