From 6f438679f61cdcfedd33ddc3a2e821f016f92186 Mon Sep 17 00:00:00 2001 From: rope Date: Tue, 29 Sep 2026 21:14:35 +0100 Subject: [PATCH] nginx: allow framing jellyfin for webOS app Co-Authored-By: Claude Opus 5.5 --- services/nginx.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/services/nginx.nix b/services/nginx.nix index 70c4df3..df9cd3e 100644 --- a/services/nginx.nix +++ b/services/nginx.nix @@ -103,7 +103,16 @@ in virtualHosts = { # --- Unprotected (own auth, or by design) --- "auth.nordhammer.it" = proxy 9091; # Authelia portal itself - "jellyfin.nordhammer.it" = proxy 8096; # streaming to external clients + # Streaming to external clients. The LG webOS app loads jellyfin-web in + # an iframe, so X-Frame-Options / frame-ancestors from securityHeaders + # blank the screen right after the server URL is entered. + "jellyfin.nordhammer.it" = lib.recursiveUpdate (proxy 8096) { + locations."/".extraConfig = '' + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + ''; + }; "seerr.nordhammer.it" = proxy 5055; # own auth via Jellyfin sign-in # Watch-party relay (services/owncast.nix). Shared basic-auth password