https://securityheaders.com/?q=blog.vapor.codes&followRedirects=on - this should be an A+ 😅

Permission Policy should be accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
Referrer Policy should be strict-origin-when-cross-origin
Server can be renamed as Vapor Blog

This removes external dependencies and allows us to lock down the CSP

https://wave.webaim.org/report#/https://blog.vapor.codes

We should pass all of the tests with no warnings or errors

Since the blog is just a static site we should deploy PRs to an S3 bucket. This allows us to see new posts before they are merged, any style changes etc and will work as a test bed for similar functionality in the website.

I have examples of how to do this so it's not a big task

We have the weird scenario where we use the generate page for error pages and paginated pages (because these are the only pages we have) but for the error page we just pass the body in and for the paginated pages we have to check for this because we pass the full HTML in. This should be changed so the theme implementation generates the page HTML correctly and the paginated code only needs to pass the body in

Link to GH docs for forking and submitting a PR, link to help wanted/good first issues boards, discuss how the review process works, adding tests, how releases work and how the release notes are generated

Topics to cover:

• documentation
• translating the docs
• API docs
• bugs
• features (should be discussed first)

In main.swift

Makes previews a bit nicer!

We can get VaporBot to automatically post new posts to the #news channel in Discord. We'll probably need to use the RSS feed and either a delayed or pooling GH action or Lambda to post it

We should have a post about how to go from returning Content to a Response with custom status code, cookies, headers etc

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

We should add a basic error page for things like 404 errors. Doesn't need to do much for now other than think to the blog home and maybe posts.

Ideally the page should be generated by Publish and we can just point to it in S3 or CloudFront

Guest blog posts might be from a fork. This currently doesn't pass CI and we try and deploy which fails because we have no secrets. We should just lint and build the site like the design site

My RSS Aggregator can't fetch the rss feed from: https://blog.vapor.codes/feed.rss because I always get the error that the content-type is: binary/octet-stream.
Shouldn't this be application/rss+xml (see: https://stackoverflow.com/questions/595616/what-is-the-correct-mime-type-to-use-for-an-rss-feed)

Explain how to save random data in the request storage for retrieval later. E.g in middleware to retrieve in a request handler.

Also explain the difference between sessions and storage

Once #19 and #21 are implemented we should have no CSP errors when viewing the site. This can be verified with the web inspector. Once this is done we can change the report only to error on failures.

We can also look at overriding the server header and change it to Vapor Blog and try and get an A+ on https://www.serpworx.com/check-security-headers/ or https://securityheaders.com

We should add dates to posts to make it clear when they were written.

We should also investigate if we can add things like authors etc. This might help https://github.com/JohnSundell/Publish/blob/master/Documentation/HowTo/custom-markdown-metadata-values.md

Deploy the stack as well as the site. We should also add a CF lint to the PR tester

this is a test issue