rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Revert "nginx: allow framing jellyfin for webOS app"

Browse source 
gixy rejects the nested add_header override.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-09-29 21:17:06 +01:00
parent 6f438679f6
commit 13cdf48a1c
1 changed files with 1 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

11
services/nginx.nix
View file

@ -103,16 +103,7 @@ in
virtualHosts = { virtualHosts = {
# --- Unprotected (own auth, or by design) --- # --- Unprotected (own auth, or by design) ---
"auth.nordhammer.it" = proxy 9091; # Authelia portal itself "auth.nordhammer.it" = proxy 9091; # Authelia portal itself
# Streaming to external clients. The LG webOS app loads jellyfin-web in "jellyfin.nordhammer.it" = proxy 8096; # streaming to external clients
# an iframe, so X-Frame-Options / frame-ancestors from securityHeaders
# blank the screen right after the server URL is entered.
"jellyfin.nordhammer.it" = lib.recursiveUpdate (proxy 8096) {
locations."/".extraConfig = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
'';
};
"seerr.nordhammer.it" = proxy 5055; # own auth via Jellyfin sign-in "seerr.nordhammer.it" = proxy 5055; # own auth via Jellyfin sign-in
# Watch-party relay (services/owncast.nix). Shared basic-auth password # Watch-party relay (services/owncast.nix). Shared basic-auth password