msfjarvis/server-config
1
Fork 0
mirror of https://github.com/msfjarvis/server-config synced 2025-08-16 14:47:00 +05:30
Code Issues Projects Releases Packages Wiki Activity Actions

Caddyfile: Setup CSP

Browse source 
Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
This commit is contained in:
Harsh Shandilya 2020-02-09 13:10:55 +05:30
parent 137cf4cca5
commit 0af27cdf57
No known key found for this signature in database
GPG key ID: B7843F823355E9B9
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Caddyfile
View file

@ -9,6 +9,14 @@
header / { header / {
Content-Security-Policy " Content-Security-Policy "
report-uri https://msfjarvis.report-uri.com/r/d/csp/reportOnly; report-uri https://msfjarvis.report-uri.com/r/d/csp/reportOnly;
default-src 'self';
style-src 'self' 'unsafe-inline' fonts.googleapis.com commento.msfjarvis.dev;
script-src 'self' 'unsafe-inline' commento.msfjarvis.dev;
font-src 'self' fonts.gstatic.com commento.msfjarvis.dev;
img-src data: 'self' imgur.com *.imgur.com;
form-action 'self';
connect-src 'self' msfjarvis.dev commento.msfjarvis.dev;
frame-ancestors 'none';
" "
# Security related changes stolen from https://github.com/searx/searx-docker/blob/master/Caddyfile # Security related changes stolen from https://github.com/searx/searx-docker/blob/master/Caddyfile
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"