mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-08-28 05:27:41 +00:00
3e881e9938
Permit GitHub App manifest form posts and signed HTTPS VNC preview iframes while keeping the rest of the SPA CSP locked down. Mirror the policy in the split-web Caddy config.
39 lines
1.4 KiB
Text
39 lines
1.4 KiB
Text
:80 {
|
|
root * /srv/web/dist
|
|
encode gzip zstd
|
|
|
|
header {
|
|
X-Content-Type-Options nosniff
|
|
X-Frame-Options DENY
|
|
Referrer-Policy strict-origin-when-cross-origin
|
|
Cross-Origin-Opener-Policy same-origin
|
|
Cross-Origin-Resource-Policy same-origin
|
|
Permissions-Policy "accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), web-share=(), xr-spatial-tracking=()"
|
|
Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://avatars.githubusercontent.com; connect-src 'self' ws: wss:; worker-src 'self' blob:; frame-src 'self' https:; manifest-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://github.com; object-src 'none'"
|
|
}
|
|
|
|
@sourceMaps path *.map
|
|
handle @sourceMaps {
|
|
respond 404
|
|
}
|
|
|
|
@cacheAssets {
|
|
path /assets/*
|
|
not path *.map
|
|
}
|
|
header @cacheAssets Cache-Control "public, max-age=31536000, immutable"
|
|
|
|
@htmlNavigation {
|
|
header Accept *text/html*
|
|
not path /assets/*
|
|
}
|
|
handle @htmlNavigation {
|
|
try_files {path} /index.html
|
|
header Cache-Control "no-cache"
|
|
file_server
|
|
}
|
|
|
|
handle {
|
|
file_server
|
|
}
|
|
}
|