rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nginx: drop frame headers for jellyfin (webOS app iframe)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-09-29 21:18:33 +01:00
parent 13cdf48a1c
commit bb45e49ed5
1 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
services/nginx.nix
View file

@ -37,11 +37,11 @@ let
# so any location below that sets add_header must re-include this string. # so any location below that sets add_header must re-include this string.
securityHeaders = '' securityHeaders = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Frame-Options $frame_options always;
add_header X-Content-Type-Options "nosniff" always; add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self' https: wss: data: blob: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self';" always; add_header Content-Security-Policy "default-src 'self' https: wss: data: blob: 'unsafe-inline' 'unsafe-eval';$frame_ancestors" always;
''; '';
# Simple reverse proxy vhost # Simple reverse proxy vhost
@ -98,6 +98,18 @@ in
appendHttpConfig = '' appendHttpConfig = ''
proxy_headers_hash_max_size 1024; proxy_headers_hash_max_size 1024;
access_log /var/log/nginx/access.log; access_log /var/log/nginx/access.log;
# The LG webOS Jellyfin app loads jellyfin-web in an iframe; frame
# restrictions blank its screen right after the server URL is entered.
# Empty value = add_header skips it (a per-location override trips gixy).
map $host $frame_options {
jellyfin.nordhammer.it "";
default "SAMEORIGIN";
}
map $host $frame_ancestors {
jellyfin.nordhammer.it "";
default " frame-ancestors 'self';";
}
'' + securityHeaders; '' + securityHeaders;
virtualHosts = { virtualHosts = {