web.config

<?xml version="1.0" encoding="utf-8" ?>

<configuration>
	<system.webServer>

		<httpErrors existingResponse="PassThrough"></httpErrors>

		<httpProtocol>
			<customHeaders>
				<!-- Remove X-Powered-By: ASP.NET - we *are* using PHP... -->
				<!-- appcmd list config /section:httpProtocol lists only this entry, so okay to clear. -->
				<clear />

				<add name="Content-Security-Policy"
				     value="default-src 'none'; font-src 'self' data:; img-src 'self' data: https://*.githubusercontent.com; style-src 'self' 'unsafe-inline'"
				 />
			</customHeaders>
		</httpProtocol>

		<rewrite>
			<rules>
				<rule name="HTTP to HTTPS redirect" enabled="false" stopProcessing="true">
					<match url="(.*)" />
					<conditions>
						<add input="{HTTPS}" pattern="off" ignoreCase="true" />
					</conditions>
					<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
				</rule>

				<rule name="Remove trailing slashes" stopProcessing="false">
					<match url="(.*)/$" />
					<conditions>
						<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
						<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
					</conditions>
					<action type="Rewrite" url="{R:1}" />
				</rule>

				<rule name="Friendly parameterised URL to actual" stopProcessing="true">
					<match url="(.*)/(.*)" />
					<conditions>
						<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
						<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
					</conditions>
					<action type="Rewrite" url="{R:1}.php?RepositoryId={R:2}" />
				</rule>

				<rule name="Friendly non-parameterised URL to actual" stopProcessing="true">
					<match url="(.*)" />
					<conditions>
						<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
						<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
						<add input="{REQUEST_FILENAME}.php" matchType="IsFile" />
					</conditions>
					<action type="Rewrite" url="{R:1}.php" />
				</rule>
			</rules>

			<outboundRules>
				<rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
					<match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
					<conditions>
						<add input="{HTTPS}" pattern="on" ignoreCase="true" />
					</conditions>
					<action type="Rewrite" value="max-age=31536000" />
				</rule>
			</outboundRules>
		</rewrite>

	</system.webServer>
</configuration>