<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <!--
  Cordova recommended default CSP. For more guidance, see:
      https://cordova.apache.org/docs/en/dev/guide/appdev/allowlist/#content-security-policy-csp
  <meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com; style-src 'self' 'unsafe-inline'; media-src *">
  Explanation:
    * gap: is required only on iOS (when using UIWebView) and is needed for JS->native communication
           Note that UIWebView is deprecated, see https://developer.apple.com/documentation/uikit/uiwebview
    * https://ssl.gstatic.com is required only on Android and is needed for TalkBack to function properly
    * Disables use of eval() and inline scripts in order to mitigate risk of XSS vulnerabilities. To change this:
        * Enable inline JS: add 'unsafe-inline' to default-src
        * Enable eval(): add 'unsafe-eval' to default-src
  -->
  <!-- Explanation:
    * allow loading resources from the same origin, inline scripts (required for inline event listeners) and styles, and the use of eval() (required by ECharts)
    * allow loading fonts from the same origin, and data: URIs
    * allow loading images from any source, and data: URIs
    * allow loading media from any source, and data:, blob: and media: URIs
    * allow embedding (<iframe>) any source
    * allow connecting (through fetch(), XMLHttpRequest, WebSocket etc.) to the same origin, raw.githubusercontent.com (add-on logos etc.), Iconify icon sources, and any source
    * allows loading web workers from the same origin, and blob: URIs
  -->
  <% if (process.env.NODE_ENV === 'production') { %>
  <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src * data:; media-src * data: blob: media:; frame-src *; connect-src 'self' raw.githubusercontent.com api.iconify.design api.unisvg.com api.simplesvg.com *; worker-src 'self' blob:;">
  <% } %>
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, minimum-scale=1, user-scalable=no, minimal-ui, viewport-fit=cover">

  <meta name="theme-color" content="#e64a19">
  <meta name="format-detection" content="telephone=no">
  <meta name="msapplication-tap-highlight" content="no">
  <title>openHAB</title>
  <% if (process.env.TARGET === 'web') { %>
  <meta name="mobile-web-app-capable" content="yes">
  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
  <link rel="apple-touch-icon" href="/res/icons/apple-touch-icon.png" type="image/png" sizes="180x180" crossorigin="use-credentials">
  <link rel="icon" href="/res/icons/favicon.svg" type="image/svg+xml" sizes="any" crossorigin="use-credentials">
  <link rel="icon" href="/res/icons/128x128.png" type="image/png" sizes="128x128" crossorigin="use-credentials">
  <link rel="manifest" href="/manifest.json" crossorigin="use-credentials">
  <% } %>
  <!-- built styles file will be auto injected -->
</head>
<body>
  <div id="app"></div>
  <!-- built script files will be auto injected -->
</body>
</html>
