# Minimal ownCloud Web CSP with the office frame origin; oCIS expands ${VAR}.
directives:
  default-src: ["'none'"]
  child-src: ["'self'"]
  connect-src: ["'self'", "blob:", "https://api.occupymedia.cc"]
  font-src: ["'self'", "data:"]
  # The Hub's in-app Drive view (app.occupymedia.cc/files/drive) frames oCIS web.
  frame-ancestors: ["'self'", "https://app.occupymedia.cc"]
  frame-src: ["'self'", "blob:", "https://${OFFICE_HOST}"]
  img-src: ["'self'", "data:", "blob:", "https://${OFFICE_HOST}"]
  manifest-src: ["'self'"]
  media-src: ["'self'"]
  object-src: ["'self'", "blob:"]
  script-src: ["'self'", "'unsafe-inline'"]
  style-src: ["'self'", "'unsafe-inline'"]