firebase.json

{
  "hosting": {
    "//": "The deploy names a target rather than a site: `firebase deploy --only hosting:prod`. Without this key that target resolves to nothing and the deploy stops with \"Hosting site or target prod not detected\". `.firebaserc` maps prod to the usefiretower-prod site.",
    "target": "prod",
    "public": "out",
    "ignore": [
      "firebase.json",
      "**/.*",
      "**/node_modules/**"
    ],
    "cleanUrls": true,
    "trailingSlash": false,
    "redirects": [
      {
        "//": "The control-plane installer: Docker and Node if missing, the CLI, then firetower install. Same rolling release as the worker's script.",
        "source": "/install.sh",
        "destination": "https://github.com/firetower-cloud/firetower/releases/download/worker-latest/install.sh",
        "type": 302
      },
      {
        "//": "The worker installer. The script is a release asset of the firetower repository, on a rolling `worker-latest` release the release job keeps current \u2014 GitHub's own `latest` is whichever package released last. The site holds no copy, so it can never be out of step with the binaries the script downloads.",
        "source": "/worker.sh",
        "destination": "https://github.com/firetower-cloud/firetower/releases/download/worker-latest/worker.sh",
        "type": 302
      },
      {
        "//": "The docs moved under /docs/self-hosting when the cloud option appeared, and split again into install and upgrade. A redirect is one line; a 404 in somebody's bookmark is not. Next's own redirects() cannot do this \u2014 an export has no server to run it.",
        "source": "/docs/self-host",
        "destination": "/docs/self-hosting",
        "type": 301
      },
      {
        "source": "/docs/install",
        "destination": "/docs/self-hosting/app/install",
        "type": 301
      },
      {
        "//": "The domain page is gone: the certificate, the records and the two ways to be reached are all on the install page now, which is where somebody following /docs/domain wanted to end up anyway.",
        "source": "/docs/domain",
        "destination": "/docs/self-hosting/app/install",
        "type": 301
      },
      {
        "source": "/docs/self-hosting/domain",
        "destination": "/docs/self-hosting/app/install",
        "type": 301
      },
      {
        "source": "/docs/hosts",
        "destination": "/docs/self-hosting/machines/install",
        "type": 301
      },
      {
        "//": "Daily operations, Connect repositories and Secrets were all removed. Nothing replaces them one-for-one, so these land on the page that explains the parts rather than on a 404.",
        "source": "/docs/operations",
        "destination": "/docs/self-hosting",
        "type": 301
      },
      {
        "source": "/docs/self-hosting/operations",
        "destination": "/docs/self-hosting",
        "type": 301
      },
      {
        "source": "/docs/repositories",
        "destination": "/docs/self-hosting",
        "type": 301
      },
      {
        "source": "/docs/secrets",
        "destination": "/docs/self-hosting",
        "type": 301
      },
      {
        "source": "/docs/self-hosting/install",
        "destination": "/docs/self-hosting/app/install",
        "type": 301
      },
      {
        "source": "/docs/self-hosting/machines",
        "destination": "/docs/self-hosting/machines/install",
        "type": 301
      },
      {
        "//": "The two upgrade pages became one Update page: upgrading is done on the Updates screen now, and splitting the deployment from the workers put the same screen on two pages.",
        "source": "/docs/self-hosting/app/upgrade",
        "destination": "/docs/update",
        "type": 301
      },
      {
        "source": "/docs/self-hosting/machines/upgrade",
        "destination": "/docs/update",
        "type": 301
      }
    ],
    "headers": [
      {
        "//": "Next's metadata routes emit real PNGs with no file extension, so Hosting would serve them as application/octet-stream and every social preview would break. Set the type explicitly. The URLs carry a build hash, so they are safe to cache forever.",
        "source": "/@(opengraph-image|apple-icon|icon)",
        "headers": [
          {
            "key": "Content-Type",
            "value": "image/png"
          },
          {
            "key": "Cache-Control",
            "value": "public, max-age=31536000, immutable"
          }
        ]
      },
      {
        "//": "Next fingerprints everything under _next/static, so these URLs can never change contents.",
        "source": "/_next/static/**",
        "headers": [
          {
            "key": "Cache-Control",
            "value": "public, max-age=31536000, immutable"
          }
        ]
      },
      {
        "//": "Fonts and extension-bearing images are content-addressed by the build too.",
        "source": "**/*.@(woff|woff2|ttf|otf|eot|png|jpg|jpeg|gif|webp|avif|ico)",
        "headers": [
          {
            "key": "Cache-Control",
            "value": "public, max-age=31536000, immutable"
          }
        ]
      },
      {
        "//": "The demo recording. Nothing under public/ is fingerprinted by the build, so the cut number lives in the filename instead \u2014 re-cutting the demo means publishing demo-1.0.* and pointing DemoVideo.tsx at it, never overwriting these bytes. Accept-Ranges so the browser can seek without refetching the file.",
        "source": "**/*.@(mp4|webm)",
        "headers": [
          {
            "key": "Cache-Control",
            "value": "public, max-age=31536000, immutable"
          },
          {
            "key": "Accept-Ranges",
            "value": "bytes"
          }
        ]
      },
      {
        "//": "HTML and the metadata text files must revalidate, or a deploy would not be visible until caches expire.",
        "source": "**/*.@(html|xml|txt|webmanifest|svg)",
        "headers": [
          {
            "key": "Cache-Control",
            "value": "public, max-age=0, must-revalidate"
          }
        ]
      },
      {
        "//": "Baseline hardening. Google Analytics is the only cross-origin thing the site loads, and none of these headers touch it \u2014 there is deliberately no CSP here, because adding one that forgets googletagmanager.com breaks measurement silently.",
        "source": "**",
        "headers": [
          {
            "key": "X-Content-Type-Options",
            "value": "nosniff"
          },
          {
            "key": "Referrer-Policy",
            "value": "strict-origin-when-cross-origin"
          },
          {
            "key": "X-Frame-Options",
            "value": "SAMEORIGIN"
          },
          {
            "key": "Strict-Transport-Security",
            "value": "max-age=31536000; includeSubDomains"
          }
        ]
      }
    ]
  }
}