# Security headers. Included at server level and again in every location with
# an add_header of its own, since nginx drops the inherited ones there.
#
# script-src: the bundle, plus the theme script inline in index.html by its
# hash. Edit that script and this hash must change with it (sha256 of the text
# between the tags, base64), or the app paints light-then-dark again;
# `bun run check` (src/csp.check.ts) fails with the new value.
# style-src 'unsafe-inline': Monaco, Radix's scroll lock and the toasts insert
# <style> elements at runtime, which no hash can name.
# img/frame-src take any http(s): a camera stream or website widget points
# wherever its dashboard says. connect-src is this origin plus the API's when
# the bundle calls one elsewhere; the Dockerfile fills that in.
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'sha256-FpmE/jXgh7LaQmoMHvqlYVa3hl7+cMNkDN2fSejs9So='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; media-src 'self' blob:; font-src 'self'; connect-src 'self'__API_ORIGINS__; worker-src 'self'; frame-src http: https:; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;