Enhancement/add csp headers (#656)

Add CSP headers and serve fonts statically

4.0/docs/stylesheets/fonts.css

@@ -0,0 +1,76 @@
+/* ==================== */
+/* IMPORT STATIC FONTS  */
+/* ==================== */
+
+/* ----- Roboto ----- */
+@font-face {
+    font-family: "Roboto";
+    src: url('/4.0/assets/fonts/Roboto-Regular.ttf') format("truetype");
+}
+
+@font-face {
+    font-family: "Roboto";
+    src: url('/4.0/assets/fonts/Roboto-Light.ttf') format("truetype");
+    font-weight: 300;
+    font-style: normal;
+}
+
+@font-face {
+    font-family: "Roboto";
+    src: url('/4.0/assets/fonts/Roboto-LightItalic.ttf') format("truetype");
+    font-weight: 300;
+    font-style: italic;
+}
+
+@font-face {
+    font-family: "Roboto";
+    src: url('/4.0/assets/fonts/Roboto-Italic.ttf') format("truetype");
+    font-weight: 400;
+    font-style: italic;
+}
+
+@font-face {
+    font-family: "Roboto";
+    src: url('/4.0/assets/fonts/Roboto-Bold.ttf') format("truetype");
+    font-weight: 700;
+    font-style: normal;
+}
+
+@font-face {
+    font-family: "Roboto";
+    src: url('/4.0/assets/fonts/Roboto-BoldItalic.ttf') format("truetype");
+    font-weight: 700;
+    font-style: italic;
+}
+
+/* ----- Roboto Mono ----- */
+@font-face {
+    font-family: "Roboto Mono";
+    src: url('/4.0/assets/fonts/RobotoMono-Regular.ttf') format("truetype");
+}
+
+@font-face {
+    font-family: "Roboto Mono";
+    src: url('/4.0/assets/fonts/RobotoMono-Italic.ttf') format("truetype");
+    font-weight: 400;
+    font-style: italic;
+}
+
+@font-face {
+    font-family: "Roboto Mono";
+    src: url('/4.0/assets/fonts/RobotoMono-Bold.ttf') format("truetype");
+    font-weight: 700;
+    font-style: normal;
+}
+
+@font-face {
+    font-family: "Roboto";
+    src: url('/4.0/assets/fonts/RobotoMono-BoldItalic.ttf') format("truetype");
+    font-weight: 700;
+    font-style: italic;
+}
+
+:root{
+    --md-text-font: "Roboto";
+    --md-code-font: "Roboto Mono";
+}

4.0/mkdocs.yml

@@ -33,9 +33,7 @@ theme:
 # Customization 
 extra:
   # Font
-  font:
-    text: Roboto Slab
-    code: Source Code Pro
+  font: false
 
   # Social
   social:
@@ -46,9 +44,9 @@ extra:
     - icon: fontawesome/brands/github
       link: https://github.com/vapor
 
-# Custom code highlighting syntax (uncomment if you want to use this. css is in `docs/stylesheets/extra.css`)
 extra_css:
   - stylesheets/syntax.css
+  - stylesheets/fonts.css
 
 extra_javascript:
   - javascripts/syntax.js

4.0/theme/404.html

@@ -22,10 +22,10 @@
 
     
   
-      <link rel="stylesheet" href="/4.0/assets/stylesheets/main.2d9f7617.min.css">
+      <link rel="stylesheet" href="/4.0/assets/stylesheets/main.e411adfe.min.css">
       
         
-        <link rel="stylesheet" href="/4.0/assets/stylesheets/palette.e6a45f82.min.css">
+        <link rel="stylesheet" href="/4.0/assets/stylesheets/palette.cc9b2e1e.min.css">
         
           
           
@@ -1350,7 +1350,7 @@
     <script id="__config" type="application/json">{"base": "/4.0/", "features": [], "translations": {"clipboard.copy": "Copy to clipboard", "clipboard.copied": "Copied to clipboard", "search.config.lang": "en", "search.config.pipeline": "trimmer, stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.placeholder": "Type to start searching", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.term.missing": "Missing", "select.version.title": "Select version"}, "search": "/4.0/assets/javascripts/workers/search.bd0b6b67.min.js"}</script>
     
     
-      <script src="/4.0/assets/javascripts/bundle.467223ff.min.js"></script>
+      <script src="/4.0/assets/javascripts/bundle.ed9748b7.min.js"></script>
       
     
   </body>

stack.yml

@@ -59,10 +59,49 @@ Resources:
             Cookies:
               Forward: none
           ViewerProtocolPolicy: redirect-to-https
+          ResponseHeadersPolicyId: !Ref WebsiteCloudFrontPolicies
         PriceClass: PriceClass_All
         ViewerCertificate:
           AcmCertificateArn: !Ref 'AcmCertificateArn'
           SslSupportMethod: sni-only
+  WebsiteCloudFrontPolicies:
+    Type: AWS::CloudFront::ResponseHeadersPolicy
+    Properties:
+      ResponseHeadersPolicyConfig:
+        Name: Docs-Security-Header-Policy
+        Comment: The Vapor Docs security header policy
+        CustomHeadersConfig:
+          Items:
+            - Header: Permissions-Policy
+              Value: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
+              Override: false
+            - Header: server
+              Value: 'Vapor Docs'
+              Override: true
+            - Header: Content-Security-Policy-Report-Only
+              Value: default-src 'none'; script-src 'self'; img-src 'self' data:; style-src 'self'; font-src 'self'; connect-src 'self'
+              Override: false
+        SecurityHeadersConfig:
+          #ContentSecurityPolicy:
+          #    ContentSecurityPolicy: default-src 'none'; script-src 'self'; img-src 'self' data:; style-src 'self'; font-src 'self'; connect-src 'self'
+          #    Override: false
+          ContentTypeOptions:
+            Override: false
+          FrameOptions:
+            FrameOption: DENY
+            Override: false
+          ReferrerPolicy:
+            ReferrerPolicy: strict-origin-when-cross-origin
+            Override: false
+          StrictTransportSecurity:
+            AccessControlMaxAgeSec: 63072000
+            IncludeSubdomains: true
+            Preload: false
+            Override: false
+          XSSProtection:
+            ModeBlock: true
+            Protection: true
+            Override: false
 Outputs:
   CloudfrontURL:
     Description: 'Cloudfront URL'