[tamimio]

It is great, I tried another one based on activity pub, but it was inconvenient as for each post you need to have a post too on Mastodon (or similar), cactus worked great in my case, but now is disabled as my CSP is preventing it, and Zola don’t have random Nonce generator yet, when I get time maybe this weekend I will try tinkering with it. I made a shortcode for it that will also take the post title as the “room id” in matrix so things are organized properly when you moderate it.

> There is also another interesting approach via emails

That’s actually really interesting, thanks for sharing it! Will give it a try once it’s published.

Btw, since you migrated to Zola, I had this issue until I found a way to solve it, if your posts are in folders and not an md file, zola by default won’t see it, to make it work, just add a “_index.md” in the parent directory with “transparent = true”, other than that, everything else worked perfectly for me.

[charlesrocket]

Not sure where Zola can fit dynamic CSP mechanics, but there might be a solution one day: https://www.netlify.com/blog/general-availability-content-se.... I might have figured out how to deploy Cactus with a strict CSP. It can't find the room tho, even when I deploy following the official guide, so this looks like something on their end (waiting for confirmation). It's on the `comments` branch if you want to test my approach https://github.com/charlesrocket/halve-z.

> if your posts are in folders and not an md file

Mandatory sections are probably for the asset colocation https://www.getzola.org/documentation/content/overview/#asse.... It's actually pretty handy; it makes the directory structure cleaner, and asset access is more direct within post pages.

[tamimio]

> Not sure where Zola can fit dynamic CSP mechanics, but there might be a solution one day: https://www.netlify.com/blog/general-availability-content-se...

That’s how I got it to work yesterday, Netlify apparently has a dynamic and Nonce generator per request, which is something Zola don’t and won’t have unless you have the nonce hardcoded which is useless.

> might have figured out how to deploy Cactus with a strict CSP. It can't find the room tho, even when I deploy following the official guide, so this looks like something on their end (waiting for confirmation)

True the room thing didn’t show up for me. Looking at your repo, I see you have it in your head as a meta tag, not the toml file, interesting approach, I can see how there’s an advantage of that since you have more control with variables, but I found that if you scan your site for CSP headers, none of them shows up, not sure if that’s a good or bad thing, nonetheless, will try it and compare it to the nonce way for a while see which one is better, thanks for sharing it!

> It's actually pretty handy; it makes the directory structure cleaner, and asset access is more direct within post pages.

Exactly, it was going to be a deal breaker for me when I migrated to Zola around a year ago, having all assets in one directory is just chaotic.

[charlesrocket]

> I found that if you scan your site for CSP headers, none of them shows up

Some scanners ignore them in the meta tag, looking only at HTTP headers (just like some browsers). I thought Netlify would merge meta CSP into an HTTP header, but it seems like this is not the case.