@maka/maka-cli 5.2.6 → 5.2.7

package/bundle/typescript/src/templates/meteor/app/server/helmet-csp.js.ts

@@ -0,0 +1,179 @@
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+const devAllowedOrigins = Meteor.settings.devAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  crossOriginOpenerPolicy: { policy: "same-origin-allow-popups" },
+  crossOriginResourcePolicy: true,
+  //If you want to embed something like an iframe, set to false
+  //If this is truu, site's won't be able to link to you
+  crossOriginEmbedderPolicy: false,
+  contentSecurityPolicy: {
+    blockAllMixedContent: true,
+    directives: {
+      defaultSrc: [self].concat(allowedOrigins),
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ].concat(allowedOrigins),
+      childSrc: [self].concat(allowedOrigins),
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data].concat(allowedOrigins),
+      formAction: [self].concat(allowedOrigins),
+      frameAncestors: [self].concat(allowedOrigins),
+      frameSrc: [self].concat(allowedOrigins),
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self].concat(allowedOrigins),
+      mediaSrc: [self].concat(allowedOrigins),
+      objectSrc: [self].concat(allowedOrigins),
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline].concat(allowedOrigins),
+      workerSrc: [self, 'blob:'].concat(allowedOrigins)
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  expectCt: {
+    enforce: true,
+    maxAge: 604800
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+};
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment && devAllowedOrigins) {
+  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  helmetOptions.contentSecurityPolicy.directives.styleSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  helmetOptions.contentSecurityPolicy.directives.imgSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+    helmetOptions.contentSecurityPolicy.directives.fontSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  helmetOptions.contentSecurityPolicy.directives['script-src-attr'] = null;
+}
+
+export default helmetOptions;

package/bundle/typescript/src/templates/meteor/app/server/helmet-csp.js.tsx

@@ -0,0 +1,179 @@
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+const devAllowedOrigins = Meteor.settings.devAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  crossOriginOpenerPolicy: { policy: "same-origin-allow-popups" },
+  crossOriginResourcePolicy: true,
+  //If you want to embed something like an iframe, set to false
+  //If this is truu, site's won't be able to link to you
+  crossOriginEmbedderPolicy: false,
+  contentSecurityPolicy: {
+    blockAllMixedContent: true,
+    directives: {
+      defaultSrc: [self].concat(allowedOrigins),
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ].concat(allowedOrigins),
+      childSrc: [self].concat(allowedOrigins),
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data].concat(allowedOrigins),
+      formAction: [self].concat(allowedOrigins),
+      frameAncestors: [self].concat(allowedOrigins),
+      frameSrc: [self].concat(allowedOrigins),
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self].concat(allowedOrigins),
+      mediaSrc: [self].concat(allowedOrigins),
+      objectSrc: [self].concat(allowedOrigins),
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline].concat(allowedOrigins),
+      workerSrc: [self, 'blob:'].concat(allowedOrigins)
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  expectCt: {
+    enforce: true,
+    maxAge: 604800
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+};
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment && devAllowedOrigins) {
+  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  helmetOptions.contentSecurityPolicy.directives.styleSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  helmetOptions.contentSecurityPolicy.directives.imgSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+    helmetOptions.contentSecurityPolicy.directives.fontSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  helmetOptions.contentSecurityPolicy.directives['script-src-attr'] = null;
+}
+
+export default helmetOptions;

package/bundle/typescript/src/templates/meteor/app/server/main.js

@@ -0,0 +1,13 @@
+import { WebApp } from 'meteor/webapp';
+import helmet from "helmet";
+import helmetOptions from './helmet-csp';
+
+const enfoceCSP = Meteor.settings.enforceCSP;
+if (enfoceCSP && !Meteor.isDevelopment) {
+  WebApp.connectHandlers.use(helmet(helmetOptions));
+}
+WebApp.addHtmlAttributeHook(() => ({ lang: Meteor.settings.language }));
+
+// See the Meteor docs for more information on directory structure
+// https://guide.meteor.com/structure#example-app-structure
+import '/imports/startup/server/index';

package/bundle/typescript/src/templates/meteor/app/server/main.js.jsx

@@ -0,0 +1,13 @@
+import { WebApp } from 'meteor/webapp';
+import helmet from "helmet";
+import helmetOptions from './helmet-csp';
+
+const enfoceCSP = Meteor.settings.enforceCSP;
+if (enfoceCSP && !Meteor.isDevelopment) {
+  WebApp.connectHandlers.use(helmet(helmetOptions));
+}
+WebApp.addHtmlAttributeHook(() => ({ lang: Meteor.settings.language }));
+
+// See the Meteor docs for more information on directory structure
+// https://guide.meteor.com/structure#example-app-structure
+import '/imports/startup/server/index';

package/bundle/typescript/src/templates/meteor/app/server/main.js.ts

@@ -0,0 +1,13 @@
+import { WebApp } from 'meteor/webapp';
+import helmet from "helmet";
+import helmetOptions from './helmet-csp';
+
+const enfoceCSP = Meteor.settings.enforceCSP;
+if (enfoceCSP && !Meteor.isDevelopment) {
+  WebApp.connectHandlers.use(helmet(helmetOptions));
+}
+WebApp.addHtmlAttributeHook(() => ({ lang: Meteor.settings.language }));
+
+// See the Meteor docs for more information on directory structure
+// https://guide.meteor.com/structure#example-app-structure
+import '/imports/startup/server/index';

package/bundle/typescript/src/templates/meteor/app/server/main.js.tsx

@@ -0,0 +1,13 @@
+import { WebApp } from 'meteor/webapp';
+import helmet from "helmet";
+import helmetOptions from './helmet-csp';
+
+const enfoceCSP = Meteor.settings.enforceCSP;
+if (enfoceCSP && !Meteor.isDevelopment) {
+  WebApp.connectHandlers.use(helmet(helmetOptions));
+}
+WebApp.addHtmlAttributeHook(() => ({ lang: Meteor.settings.language }));
+
+// See the Meteor docs for more information on directory structure
+// https://guide.meteor.com/structure#example-app-structure
+import '/imports/startup/server/index';

package/bundle/typescript/src/templates/meteor/app/tsconfig.json

@@ -0,0 +1,40 @@
+{
+  "compilerOptions": {
+    /* Basic Options */
+    "target": "es2018",
+    "module": "esNext",
+    "lib": ["esnext", "dom"],
+    "allowJs": true,
+    "checkJs": false,
+    "jsx": "preserve",
+    "incremental": true,
+    "noEmit": true,
+
+    /* Strict Type-Checking Options */
+    "strict": true,
+    "noImplicitAny": true,
+    "strictNullChecks": true,
+
+    /* Additional Checks */
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noImplicitReturns": false,
+    "noFallthroughCasesInSwitch": false,
+
+    /* Module Resolution Options */
+    "baseUrl": ".",
+    "paths": {
+      /* Support absolute /imports/* with a leading '/' */
+      "/*": ["*"]
+    },
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "types": ["node", "mocha"],
+    "esModuleInterop": true,
+    "preserveSymlinks": true
+  },
+  "exclude": [
+    "./.meteor/**",
+    "./packages/**"
+  ]
+}

package/bundle/typescript/src/templates/meteor/collection/collection.js

@@ -0,0 +1,51 @@
+import { Mongo } from 'meteor/mongo';<% if (where === 'client') { -%>
+export const <%= name %> = new Mongo.Collection(null);<% } else { -%>
+
+class <%= name %>Collection extends Mongo.Collection {
+  constructor() {
+    super('<%= name %>');
+
+    this.publicFields = {};
+    this.privateFields = {};
+    this.allow({
+      insert() { return false; },
+      update() { return false; },
+      remove() { return false; },
+    });
+  }
+
+  async createIndexAsync(index, options) {
+    return await createIndexAsync(index, options);
+  }
+
+  find(selector = {}, modifier) {
+    return super.find(selector, modifier);
+  }
+
+  async findOneAsync(selector = {}, modifier) {
+    return await super.findOneAsync(selector, modifier);
+  }
+
+  async insertAsync(doc) {
+    return await super.insertAsync(doc);
+  }
+
+  async updateAsync(selector, modifier) {
+    return await super.updateAsync(selector, modifier);
+  }
+
+  async upsertAsync(selector, modifier, options) {
+    return await super.upsertAsync(selector, modifier, options);
+  }
+
+  async remove(selector) {
+    return await super.removeAsync(selector);
+  }
+}
+
+/**
+ * @memberof Server.<%= name %>
+ * @member <%= name %>
+ */
+const <%= name %> = new <%= name %>Collection();
+export default <%= name %>;<% } %>

package/bundle/typescript/src/templates/meteor/collection/collection.js.ts

@@ -0,0 +1,55 @@
+import { Mongo } from 'meteor/mongo';<% if (where === 'client') { -%>
+export const <%= name %> = new Mongo.Collection(null);<% } else { %>
+
+class <%= name %>Collection extends Mongo.Collection<<%=name%>Collection> {
+ publicFields: any;
+  privateFields: any;
+  allow: any = () => {};
+
+  constructor() {
+    super('<%= name %>');
+
+    this.publicFields = {};
+    this.privateFields = {};
+    this.allow({
+      insert() { return false; },
+      update() { return false; },
+      remove() { return false; },
+    });
+  }
+
+  async createIndexAsync(index: any, options: any) {
+    return await createIndexAsync(index, options);
+  }
+
+  find(selector = {}, modifier?: any) {
+    return super.find(selector, modifier);
+  }
+
+  async findOneAsync(selector = {}, modifier?: any) {
+    return super.findOneAsync(selector, modifier);
+  }
+
+  async insertAsync(doc: any) {
+    return await super.insertAsync(doc);
+  }
+
+  async updateAsync(selector: any, modifier?: any) {
+    return await super.updateAsync(selector, modifier);
+  }
+
+  async upsertAsync(selector: any, modifier?: any, options?: any) {
+    return await super.upsertAsync(selector, modifier, options);
+  }
+
+  async removeAsync(selector: any) {
+    return await super.removeAsync(selector);
+  }
+}
+
+/**
+ * @memberof Server.<%= name %>
+ * @member <%= name %>
+ */
+const <%= name %> = new <%= name %>Collection();
+export default <%= name %>;<% } %>

package/bundle/typescript/src/templates/meteor/collection/tests.js

@@ -0,0 +1,27 @@
+/* eslint-env jasmine */
+import { Meteor } from 'meteor/meteor';
+
+if (Meteor.isServer) {
+  import <%= name %> from './<%= fileName %>';
+  describe('<%= name %>', () => {
+    <% if (test === 'jasmine') { %>
+       it('has been defined', () => {
+         let isDefined = false;
+         if(<%= name %>) {
+           isDefined = true;
+         }
+
+         expect(isDefined).toBe(true);
+
+       });
+    <% } else if (test === 'mocha') { %>
+       it('has been defined', () => {
+         let isDefined = false;
+         if(<%= name %>) {
+           isDefined = true;
+         }
+         assert.equal(isDefined, true);
+       });
+     <% } %>
+  });
+}

package/bundle/typescript/src/templates/meteor/collection/tests.js.ts

@@ -0,0 +1,27 @@
+/* eslint-env jasmine */
+import { Meteor } from 'meteor/meteor';
+
+if (Meteor.isServer) {
+  import <%= name %> from './<%= fileName %>';
+  describe('<%= name %>', () => {
+    <% if (test === 'jasmine') { %>
+       it('has been defined', () => {
+         let isDefined = false;
+         if(<%= name %>) {
+           isDefined = true;
+         }
+
+         expect(isDefined).toBe(true);
+
+       });
+    <% } else if (test === 'mocha') { %>
+       it('has been defined', () => {
+         let isDefined = false;
+         if(<%= name %>) {
+           isDefined = true;
+         }
+         assert.equal(isDefined, true);
+       });
+     <% } %>
+  });
+}

package/bundle/typescript/src/templates/meteor/config/docker-compose.yaml

@@ -0,0 +1,17 @@
+version: "3.7"
+services:
+  <%= app %>:
+    image: "<%= appFileCase %>:latest"
+    ports:
+      - 80:3000
+    volumes:
+      - ./pm2.config.js:/home/ubuntu/pm2.config.js
+      - ./settings.json:/home/ubuntu/settings.json
+
+  mongo:
+    image: "mongo"
+    ports:
+      - 27017:27017
+
+networks:
+    default:

package/bundle/typescript/src/templates/meteor/config/pm2.config.js

@@ -0,0 +1,27 @@
+const meteorSettings = require('./settings.json');
+
+const PORT = 3000;
+
+module.exports = {
+  apps : [
+      {
+        name: '<%= app %>',
+        script: './bundle/main.js',
+        instance_var: 'PROCESS_ID',
+        watch: false,
+        env: {
+          ROOT_URL: `http://0.0.0.0<% if (isDocker) { %>:${PORT}<% } %>`,
+          PORT,
+          MONGO_URL: 'mongodb://<% if (isDocker) { %>mongo<% } else { %>localhost<% } %>:27017/<%= app %>',
+          MAIL_URL: 'smtp://username:password@host:port',
+          METEOR_SETTINGS: { ...meteorSettings },
+        },
+        node_args: "--max_old_space_size=1024",
+        max_memory_restart: '300M',
+        exp_backoff_restart_delay: 100,
+        //instances: 'max',
+        //exec_mode: 'cluster',
+      }
+  ]
+}
+

package/bundle/typescript/src/templates/meteor/config/process.env

@@ -0,0 +1,5 @@
+# These values are for running this environment locally.
+# Configure prod environment values for your deployment (pm2, galaxy)
+#MAIL_URL="smtp://gmail.com:25"
+#MONGO_URL="mongodb://localhost:27017/<%= app %>"
+#ROOT_URL="http://localhost:3000"

package/bundle/typescript/src/templates/meteor/config/settings.json

@@ -0,0 +1,11 @@
+{
+  "public": {
+    "logoutOnClose": false,
+    "enableServiceWorker": false
+  },
+  "//server": "//Will not run on client",
+  "language": "en",
+  "extraAllowedOrigins": [""],
+  "devAllowedOrigins": ["cdn.jsdelivr.net", "fonts.googleapis.com", "fonts.gstatic.com"],
+  "enforceCSP": true
+}