diff --git a/content/leo/index.md b/content/leo/index.md
index 40ef632a..ba99567a 100644
--- a/content/leo/index.md
+++ b/content/leo/index.md
@@ -11,4 +11,4 @@ resources:
- src: "thumb.png"
---
-Video is property of [Leo Laporte](https://leolaporte.com/) and [G4techTV / HOW TO Channel](https://en.wikipedia.org/wiki/G4techTV). © 2007.
+Video is property of [G4techTV Canada](https://web.archive.org/web/20070511004304/http://www.g4techtv.ca/) & [Leo Laporte](https://leolaporte.com/). © 2007 G4 Media, Inc.
diff --git a/content/notes/dark-mode/example.html b/content/notes/dark-mode/example.html
index a39b65f4..6ac9a6c1 100644
--- a/content/notes/dark-mode/example.html
+++ b/content/notes/dark-mode/example.html
@@ -44,6 +44,7 @@
View the source code or read the post.
diff --git a/content/notes/dark-mode/index.md b/content/notes/dark-mode/index.md
index 38454276..18e381c5 100644
--- a/content/notes/dark-mode/index.md
+++ b/content/notes/dark-mode/index.md
@@ -39,9 +39,9 @@ I've written a simple implementation below, which...
...meaning that any CSS selectors beginning with `body.dark` or `body.light` will only apply when the respective mode is active. A good place to start is by separating any color rules --- your background, text, links, etc. --- into a different section of your CSS. Using [SASS or SCSS](https://sass-lang.com/) makes this a whole lot [easier with nesting](https://sass-lang.com/guide#topic-3) but is not required; this was written with a [KISS](https://getyarn.io/yarn-clip/embed/eed08f4f-d1c9-4cc0-b041-f280a5dbf0a5?autoplay=false) mentality.
-{{< iframe src="https://jakejarvis.github.io/dark-mode-example/" width="650" height="275" title="Dark Mode Example" sandbox="allow-same-origin allow-scripts allow-popups" >}}
+{{< iframe src="/notes/dark-mode/example.html" width="650" height="275" title="Dark Mode Example" sandbox="allow-same-origin allow-scripts allow-popups" >}}
-A _very_ barebones example is embedded above ([view the source here](https://github.com/jakejarvis/dark-mode-example), or [open in a new window](https://jakejarvis.github.io/dark-mode-example/) if your browser is blocking the frame) and you can try it out on this site by clicking the 💡 lightbulb in the upper right corner of this page. You'll notice that the dark theme sticks when refreshing this page, navigating between other pages, or if you were to return to this example weeks from now.
+A _very_ barebones example is embedded above ([view the source here](https://github.com/jakejarvis/dark-mode-example), or [open in a new window](/notes/dark-mode/example.html) if your browser is blocking the frame) and you can try it out on this site by clicking the 💡 lightbulb in the upper right corner of this page. You'll notice that the dark theme sticks when refreshing this page, navigating between other pages, or if you were to return to this example weeks from now.
---
diff --git a/netlify.toml b/netlify.toml
index aa451047..24651a79 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -61,6 +61,41 @@
# _redirects files generated by Hugo. These are additional custom rules, mostly
# unrelated to the actual website.
+# Global security headers:
+[[headers]]
+ for = "/*"
+ [headers.values]
+ # https://amp.dev/documentation/guides-and-tutorials/optimize-and-measure/secure-pages/
+ Content-Security-Policy = '''
+ default-src 'self';
+ connect-src 'self' https://*.ampproject.net https://csp-collector.appspot.com/csp/amp https://api.github.com https://platform.twitter.com;
+ font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com;
+ form-action 'none';
+ frame-ancestors 'self';
+ frame-src 'self' https://jakejarvis.github.io https://*.ampproject.net https://cdn.ampproject.org https://app.usefathom.com https://buttons.github.io https://codepen.io https://cdpn.io https://platform.twitter.com https://player.vimeo.com https://www.youtube-nocookie.com;
+ img-src 'self' data: https:;
+ manifest-src 'self';
+ media-src 'self' data: https:;
+ object-src 'none';
+ script-src 'self' 'unsafe-eval' https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/ https://cdn.ampproject.org/rtv/ https://3p.ampproject.net https://buttons.github.io https://gist.github.com https://syndication.twitter.com https://platform.twitter.com https://player.vimeo.com 'sha256-JGG0npUp+0ABq/NY1azjpQ0WBtm+m5gU58mzF+2DCXY=';
+ style-src 'self' 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://fonts.googleapis.com https://github.githubassets.com;
+ worker-src 'self';
+ block-all-mixed-content;
+ report-uri https://jarv.is/api/csp_wizard;
+ report-to default'''
+ NEL = '''
+ {"report_to":"default","max_age":604800}'''
+ Report-To = '''
+ {"group":"default","max_age":604800,"endpoints":[{"url":"https://jarv.is/api/report"}],"include_subdomains":false}'''
+ # More generic security headers:
+ Feature-Policy = "accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'"
+ Permissions-Policy = "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
+ Referrer-Policy = "no-referrer-when-downgrade"
+ X-Content-Type-Options = "nosniff"
+ X-Frame-Options = "SAMEORIGIN"
+ X-XSS-Protection = "1; mode=block"
+ X-View-Source = "https://jrvs.io/src"
+ X-Got-Milk = "2%"
# PGP key: open in browser, download correctly
[[headers]]
for = "/jarvis.asc"
@@ -88,17 +123,6 @@
# External API redirects/mirrors:
# Must set `force = true` and wildcard /api/* rule goes last.
-## Webmention.io endpoints
-[[redirects]]
- from = "/api/mention"
- to = "https://webmention.io/jarv.is/webmention"
- status = 200
- force = true
-[[redirects]]
- from = "/api/ping"
- to = "https://webmention.io/jarv.is/xmlrpc"
- status = 200
- force = true
## Report URI endpoints
[[redirects]]
from = "/api/report"
@@ -110,46 +134,23 @@
to = "https://jarvis.report-uri.com/r/d/csp/enforce"
status = 200
force = true
+## Fathom Analytics endpoint
[[redirects]]
from = "/api/count_view*"
to = "https://starman.fathomdns.com/:splat"
status = 200
force = true
-[[headers]]
- for = "/*"
- [headers.values]
- # https://amp.dev/documentation/guides-and-tutorials/optimize-and-measure/secure-pages/
- Content-Security-Policy = '''
- default-src 'self';
- connect-src 'self' https://*.ampproject.net https://csp-collector.appspot.com/csp/amp https://api.github.com https://platform.twitter.com;
- font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com;
- form-action 'none';
- frame-ancestors 'self';
- frame-src 'self' https://jakejarvis.github.io https://*.ampproject.net https://cdn.ampproject.org https://app.usefathom.com https://buttons.github.io https://codepen.io https://cdpn.io https://platform.twitter.com https://player.vimeo.com https://www.youtube-nocookie.com;
- img-src 'self' data: https:;
- manifest-src 'self';
- media-src 'self' data: https:;
- object-src 'none';
- script-src 'self' 'unsafe-eval' https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/ https://cdn.ampproject.org/rtv/ https://3p.ampproject.net https://buttons.github.io https://gist.github.com https://syndication.twitter.com https://platform.twitter.com https://player.vimeo.com;
- style-src 'self' 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://fonts.googleapis.com https://github.githubassets.com;
- worker-src 'self';
- block-all-mixed-content;
- report-uri https://jarv.is/api/csp_wizard;
- report-to default'''
- NEL = '''
- {"report_to":"default","max_age":604800}'''
- Report-To = '''
- {"group":"default","max_age":604800,"endpoints":[{"url":"https://jarv.is/api/report"}],"include_subdomains":false}'''
- # More generic security headers:
- Feature-Policy = "accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'"
- Permissions-Policy = "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
- Referrer-Policy = "no-referrer-when-downgrade"
- X-Content-Type-Options = "nosniff"
- X-Frame-Options = "SAMEORIGIN"
- X-XSS-Protection = "1; mode=block"
- X-XSS-Pwnage = "