From bb45e49ed574be5c502291a412baf83107496c94 Mon Sep 17 00:00:00 2001 From: rope Date: Tue, 29 Sep 2026 21:18:33 +0100 Subject: [PATCH] nginx: drop frame headers for jellyfin (webOS app iframe) Co-Authored-By: Claude Opus 5.5 --- services/nginx.nix | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/services/nginx.nix b/services/nginx.nix index 70c4df3..ea200aa 100644 --- a/services/nginx.nix +++ b/services/nginx.nix @@ -37,11 +37,11 @@ let # so any location below that sets add_header must re-include this string. securityHeaders = '' add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Frame-Options $frame_options always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; - add_header Content-Security-Policy "default-src 'self' https: wss: data: blob: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self';" always; + add_header Content-Security-Policy "default-src 'self' https: wss: data: blob: 'unsafe-inline' 'unsafe-eval';$frame_ancestors" always; ''; # Simple reverse proxy vhost @@ -98,6 +98,18 @@ in appendHttpConfig = '' proxy_headers_hash_max_size 1024; access_log /var/log/nginx/access.log; + + # The LG webOS Jellyfin app loads jellyfin-web in an iframe; frame + # restrictions blank its screen right after the server URL is entered. + # Empty value = add_header skips it (a per-location override trips gixy). + map $host $frame_options { + jellyfin.nordhammer.it ""; + default "SAMEORIGIN"; + } + map $host $frame_ancestors { + jellyfin.nordhammer.it ""; + default " frame-ancestors 'self';"; + } '' + securityHeaders; virtualHosts = {