Example netlify config

netlify.toml

# Settings in the [build] context are global and are applied to all contexts 
# unless otherwise overridden by more specific contexts.  
[build]
  # Directory to change to before starting a build. 
  # This is where we will look for package.json/.nvmrc/etc.
  base = "project/"

  # Directory (relative to root of your repo) that contains the deploy-ready 
  # HTML files and assets generated by the build. If a base directory has
  # been specified, include it in the publish directory path.
  publish = "project/build-output/"

  # Default build command.
  command = "echo 'default context'"

  # Directory with the serverless Lambda functions to deploy to AWS.
  functions = "project/functions/"

# Production context: all deploys from the Production branch set in your site's 
# deploy contexts will inherit these settings.
[context.production]
  publish = "project/output/"
  command = "make publish"
  environment = { ACCESS_TOKEN = "super secret", NODE_VERSION = "8.0.1" }

# Deploy Preview context: all deploys resulting from a pull/merge request will 
# inherit these settings.
[context.deploy-preview]
  publish = "project/dist/"

# Here is another way to define context specific environment variables.
[context.deploy-preview.environment]
  ACCESS_TOKEN = "not so secret"

# Branch Deploy context: all deploys that are not from a pull/merge request or 
# from the Production branch will inherit these settings.
[context.branch-deploy]
  command = "echo branch"
[context.branch-deploy.environment]
  NODE_ENV = "development"

# Specific branch context: all deploys from this specific branch will inherit
# these settings.
[context.staging] # 'staging' is a branch name
  command = "echo 'staging'"
  base = "staging"

# For contexts of branches with special characters, enclose the branch name 
# with quotes.
[context."feat/branch"]
  command = "echo 'special branch'"
  base = "branch"

# Redirects and headers are GLOBAL for all builds – they do not get scoped to 
# contexts no matter where you define them in the file.
# For context-specific rules, use _headers or _redirects files, which are 
# PER-DEPLOY.

# A basic redirect rule
[[redirects]]
  from = "/*"
  to = "/blog/:splat"

# A redirect rule with all the supported properties
[[redirects]]
  from = "/old-path"
  to = "/new-path"

  # The default HTTP status code is 301, but you can define a different one.
  status = 302

  # By default, redirects won't be applied if there's a file with the same 
  # path as the one defined in the `from` property. Setting `force` to `true` 
  # will make the redirect rule take precedence over any existing files.
  force = true

  # Redirect from /old-path?id=123 to /new-path. Each combination of query 
  # params needs to be defined in a separate [[redirects]] block. 
  # More information at https://www.netlify.com/docs/redirects/#query-params
  query = {id = ":id"}

  # Redirect based on browser language, geolocation, and/or identity role.
  conditions = {Language = ["en"], Country = ["US"]}

  # Sign each request with a value defined in an environment variable
  signed = "API_SIGNATURE_TOKEN"

  # You can also define custom headers within your redirects blocks.
  [redirects.headers]
    X-From = "Netlify"
    X-Api-Key = "some-api-key-string"

# Role-based redirects does not have a 'to' property.
[[redirects]]
  from = "/gated-path"
  status = 200
  conditions = {Role = ["admin"]}
  force = true

# The following redirect is intended for use with most SPAs that handle
# routing internally.
[[redirects]]
  from = "/*"
  to = "/index.html"
  status = 200

[[headers]]
  # Define which paths this specific [[headers]] block will cover.
  for = "/*"

  [headers.values]
    X-Frame-Options = "DENY"
    X-XSS-Protection = "1; mode=block"
    Content-Security-Policy = "frame-ancestors https://www.facebook.com"

    # Multi-key header rules are expressed with multi-line strings.
	cache-control = '''
	max-age=0,
	no-cache,
	no-store,
	must-revalidate'''

    # Basic-Auth allows you to password protect your whole site. 
    # This feature may not be available on all plans.
    Basic-Auth = "someuser:somepassword anotheruser:anotherpassword"