# Codex shared security headers. Included from every Codex vhost.
#
# Per-host CSP lives in csp-dashboard.conf, csp-api.conf, csp-admin.conf —
# CSP isn't included here because it differs between hosts. Everything in
# THIS file applies uniformly to both api.codex.philiprehberger.com and
# codex.philiprehberger.com.

<IfModule mod_headers.c>
    # Block iframe embedding entirely. The dashboard never needs to be
    # framed, and the api host has no UI surface to frame.
    Header always set X-Frame-Options "DENY"

    # MIME-sniffing defence — browsers should trust Content-Type.
    Header always set X-Content-Type-Options "nosniff"

    # Referrer policy: send origin to cross-site requests, full URL to
    # same-origin. Standard tradeoff between analytics value and privacy.
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # No surprise sensors. Camera / microphone / geolocation never
    # legitimately needed by either Codex host.
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

    # HSTS — only after manual verification HTTPS is reachable and
    # certbot has issued the cert. NO 'preload' directive: preload
    # commits the entire philiprehberger.com zone (every current +
    # future subdomain) to HTTPS-only for 6-12 months. Submit to
    # hstspreload.org as a separate explicit decision after auditing
    # every existing + planned subdomain.
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>