security.txt

Signed-off-by: Martin Berg Alstad <git@martials.no>

.env

@@ -1,2 +1,3 @@
-GIT_URL="https://git.martials.no"
+DOMAIN="martials.no"
-STATUS_URL="https://status.martials.no/status/home"
+GIT_URL=https://git.$DOMAIN
+STATUS_URL="https://status.$DOMAIN/status/home"

public/.well-known/security.txt

@@ -0,0 +1,4 @@
+Contact: mailto:security@martials.no
+Expires: 2029-12-31T23:00:00.000Z
+Preferred-Languages: no,en
+Canonical: https://martials.no/.well-known/security.txt

src/env.d.ts

@@ -2,6 +2,7 @@
 /// <reference types="astro/client" />
 
 interface ImportMetaEnv {
+  readonly DOMAIN: string
   readonly URL: string
   readonly GIT_URL: string
   readonly STATUS_URL: string

src/pages/.well-known/security.txt.ts

@@ -0,0 +1,15 @@
+import type { APIRoute } from "astro"
+
+function getSecurityTxt(site?: URL) {
+  const canonical = new URL("/.well-known/security.txt", site)
+  return `
+Contact: mailto:security@martials.no
+Expires: 2029-12-31T23:00:00.000Z
+Preferred-Languages: no,en
+Canonical: ${canonical.href}
+`
+}
+
+export const GET: APIRoute = ({ site }) => {
+  return new Response(getSecurityTxt(site))
+}