diff options
Diffstat (limited to 'cmd/mirumd/static_dev.go')
| -rw-r--r-- | cmd/mirumd/static_dev.go | 36 | +36 −0 |
1 files changed, 36 insertions, 0 deletions
diff --git a/cmd/mirumd/static_dev.go b/cmd/mirumd/static_dev.go new file mode 100644 --- /dev/null +++ b/cmd/mirumd/static_dev.go @@ -0,0 +1,36 @@ +// Copyright (c) 2026 Nikolay Govorov +// SPDX-License-Identifier: AGPL-3.0-or-later + +//go:build dev + +package main + +import "embed" + +// viteDevURL points the HTML shell at a running Vite dev server when the +// binary is built with `go build -tags dev`. Hot module replacement and +// source modules are fetched from there instead of the embedded static/. +const viteDevWs = "ws://localhost:5173" +const viteDevURL = "http://localhost:5173" + +const cspBase = "default-src 'self'; " + + "base-uri 'none'; " + + "img-src 'self' data: " + viteDevURL + "; " + + "font-src 'self' " + viteDevURL + "; " + + "style-src-attr 'unsafe-inline'; " + + "object-src 'none'; " + + "connect-src 'self' " + viteDevURL + " " + viteDevWs + "; " + + "form-action 'self'; " + + "frame-ancestors 'none'" + +// csp applied globally to every response as a safety net. +// For HTML pages it is overridden per-entry in renderPage. +// 'unsafe-inline' is necessary for the @vitejs/plugin-react HMR preamble +// that renderPage injects inline in dev mode. +const csp = cspBase + + "; script-src 'self' 'unsafe-inline' " + viteDevURL + + "; style-src 'self' 'unsafe-inline' " + viteDevURL + +// Empty in dev builds: assets are served by the Vite dev server. +var manifestJSON []byte +var assetsFS embed.FS |