the server including helmet and sapper middleware

server.js

import './css/tailwind.css';
import * as sapper from '@sapper/server';
import compression from 'compression';
import express from 'express';
import helmet from "helmet";
import sirv from 'sirv';

const {
	PORT,
	NODE_ENV
} = process.env;
const dev = NODE_ENV === 'development';

const app = express();


if ( dev ) app.use( sirv( 'static', { dev } ) );

// TODO: enable content security policy with helmet https://helmetjs.github.io/docs/csp/
app.use(
	helmet(),
	sapper.middleware(),
	compression({ threshold: 0 })
);

if ( dev ) {
	// only listen when started in dev
	app.listen( PORT, err => {
		if ( err ) console.log( 'error', err );
	} );
}

export {
	app
};