glass beadian
6cdffa60b2
infra/occupymedia/files/ was gitignored in phase one ('nothing deployed');
the oCIS deployment is now live, and the storage doc + DEPLOY.md link to its
runbook. Track the secret-free scaffold (compose.yml, csp.yaml, README,
tuwunel example, .env.example); keep only .env + secrets/ ignored.
compose.yml carries the deployment-proven fixes: ocis runs as user 1000 with
OCIS_CONFIG_DIR=/etc/ocis and HOME=/var/lib/ocis (source-built images do not
inherit the official image's conventions), and 9200/9980 publish on the LAN
for the CT150 tunnel connector.
14 lines
534 B
YAML
14 lines
534 B
YAML
# Minimal ownCloud Web CSP with the office frame origin; oCIS expands ${VAR}.
|
|
directives:
|
|
default-src: ["'none'"]
|
|
child-src: ["'self'"]
|
|
connect-src: ["'self'", "blob:"]
|
|
font-src: ["'self'", "data:"]
|
|
frame-ancestors: ["'self'"]
|
|
frame-src: ["'self'", "blob:", "https://${OFFICE_HOST}"]
|
|
img-src: ["'self'", "data:", "blob:", "https://${OFFICE_HOST}"]
|
|
manifest-src: ["'self'"]
|
|
media-src: ["'self'"]
|
|
object-src: ["'self'", "blob:"]
|
|
script-src: ["'self'", "'unsafe-inline'"]
|
|
style-src: ["'self'", "'unsafe-inline'"]
|