From f344c27478d673097b7d8108fd2ee2635c9a6c52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Fri, 27 Mar 2026 21:34:41 +0100 Subject: [PATCH] Allow Planner to connect to Journal in CSP The Planner's save-to-journal callback makes a cross-origin request to trails.cool from planner.trails.cool. Add the Journal's origin to the Planner's connect-src CSP directive. Co-Authored-By: Claude Opus 4.6 (1M context) --- infrastructure/Caddyfile | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/infrastructure/Caddyfile b/infrastructure/Caddyfile index 84d4eaf..f2a61b6 100644 --- a/infrastructure/Caddyfile +++ b/infrastructure/Caddyfile @@ -40,7 +40,14 @@ grafana.internal.{$DOMAIN:trails.cool} { } planner.{$DOMAIN:trails.cool} { - import security_headers + header { + Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + X-Content-Type-Options "nosniff" + X-Frame-Options "DENY" + Referrer-Policy "strict-origin-when-cross-origin" + Permissions-Policy "camera=(), microphone=(), geolocation=()" + Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.tile.openstreetmap.org; connect-src 'self' wss: https://{$DOMAIN:trails.cool} https://*.sentry.io https://*.ingest.de.sentry.io; font-src 'self';" + } import block_scanners log { output stdout