netlify.toml

[build]
    command = "hugo"
    publish = "public"
    functions = "functions"

[context.production.environment]
    HUGO_ENV = "production"
    NODE_ENV = "production"

[context.deploy-preview]
    command = "hugo -b $DEPLOY_PRIME_URL"

[context.branch-deploy]
    command = "hugo -b $DEPLOY_PRIME_URL"

[[headers]]
  for = "/*"
  [headers.values]
    Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload;"
    X-Frame-Options = "DENY"
    X-XSS-Protection = "1; mode=block"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "origin"
    Feature-Policy = "geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment 'none';"
    Content-Security-Policy = "default-src 'none'; base-uri 'self'; manifest-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src data: 'self'; font-src 'self'"