homeio

1import { createRequire } from "module";
2
3const require = createRequire(import.meta.url);
4const pkg = require("./package.json");
5
6/** @type {import('next').NextConfig} */
7const nextConfig = {
8  experimental: {
9    proxyClientMaxBodySize: "10gb",
10    serverActions: {
11      bodySizeLimit: "10gb",
12    },
13    // Next 16.3 made the tsc CLI the default, which type-checks test files
14    // too. Keep checking only the app, as 16.2 did.
15    useTypeScriptCli: false,
16  },
17  // "standalone" is set via NEXT_OUTPUT env var during Docker builds only
18  ...(process.env.NEXT_OUTPUT === "standalone" ? { output: "standalone" } : {}),
19  images: {
20    unoptimized: true,
21  },
22  env: {
23    NEXT_PUBLIC_APP_VERSION: pkg.version,
24  },
25  async headers() {
26    return [
27      {
28        // Homeio controls the whole machine (shutdown, disk format, app
29        // install), so the dashboard must never be embedded in another site:
30        // without this a hidden iframe could clickjack an admin into acting.
31        // Set at the app so the tunnel, a bare nginx and the Docker image all
32        // carry it. `frame-ancestors 'none'` is the only CSP directive here —
33        // a full script/style policy would need per-response nonces and risks
34        // breaking the app, while framing protection costs nothing.
35        source: "/:path*",
36        headers: [
37          { key: "X-Frame-Options", value: "DENY" },
38          { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
39          { key: "X-Content-Type-Options", value: "nosniff" },
40          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
41          // The dashboard uses no camera or microphone; deny them so a future
42          // XSS cannot either. Geolocation stays allowed for Homeio's own
43          // pages, which use it for the weather in the top bar.
44          {
45            key: "Permissions-Policy",
46            value: "camera=(), microphone=(), geolocation=(self)",
47          },
48          // Honoured only over HTTPS (the Cloudflare tunnel), ignored on a
49          // plain-HTTP LAN address, so it is safe to send everywhere.
50          {
51            key: "Strict-Transport-Security",
52            value: "max-age=63072000; includeSubDomains",
53          },
54        ],
55      },
56      {
57        // Wallpapers ship with the release and never change under a given
58        // name, but public/ is served with max-age=0, so every switch
59        // re-downloaded ~365 KB — twice, since the accent-colour sampler
60        // fetches the image again. Over a tunnel that is seconds of a click
61        // doing nothing.
62        source: "/images/:path*",
63        headers: [
64          {
65            key: "Cache-Control",
66            value: "public, max-age=31536000, immutable",
67          },
68        ],
69      },
70    ];
71  },
72};
73
74export default nextConfig;
75