<configuration>

<system.webServer>

<httpErrors existingResponse="PassThrough" />

<handlers>

<add name="iisnode" path="entry.js" verb="*" modules="iisnode" />

</handlers>

<rewrite>

<rules>

<rule name="LetsEncrypt" stopProcessing="true">

<match url="\.well-known\/acme-challenge\/(.*)" />

<action type="None" />

</rule>

<rule name="HTTP to HTTPS redirect" stopProcessing="true">

<match url="(.*)" />

<conditions>

<add input="{HTTPS}" pattern="off" ignoreCase="true" />

</conditions>

<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />

</rule>

<rule name="StaticContent">

<action type="Rewrite" url="content/files{REQUEST_URI}" />

</rule>

<rule name="DynamicContent">

<conditions>

<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="True" />

</conditions>

<action type="Rewrite" url="entry.js" />

</rule>

</rules>

<outboundRules>

<rule name="Add Strict-Transport-Security when HTTPS" enabled="true">

<match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />

<conditions>

<add input="{HTTPS}" pattern="on" ignoreCase="true" />

</conditions>

<action type="Rewrite" value="max-age=31536000" />

</rule>

</outboundRules>

</rewrite>

<httpProtocol>

<customHeaders>

<add name="X-Frame-Options" value="SAMEORIGIN"/>

<add name="X-Content-Type-Options" value="nosniff"/>

<add name="Content-Security-Policy" value="upgrade-insecure-requests; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; object-src 'none';"/>

<add name="Permissions-Policy" value="accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self)" />

<add name="Referrer-Policy" value="strict-origin-when-cross-origin"/>

<remove name="X-Powered-By" />

</customHeaders>

</httpProtocol>

<security>

<requestFiltering removeServerHeader="true" />

</security>

</system.webServer>

</configuration>