From f08da5f8f041ffadfcd59be5644841cdbda99f3a Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Wed, 11 May 2022 18:27:11 -0500
Subject: [PATCH] Mastodon nginx: add commented out CSP

---
 installation/mastodon.conf | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/installation/mastodon.conf b/installation/mastodon.conf
index 8c1feea65..21b6f9d46 100644
--- a/installation/mastodon.conf
+++ b/installation/mastodon.conf
@@ -70,6 +70,10 @@ server {
 
   add_header Strict-Transport-Security "max-age=31536000" always;
 
+  # Content Security Policy (CSP)
+  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+  # add_header Content-Security-Policy "base-uri 'none'; default-src 'none'; font-src 'self'; img-src 'self' https: data: blob:; style-src 'self' 'unsafe-inline'; media-src 'self' https: data:; frame-src 'self' https:; manifest-src 'self'; connect-src 'self' data: blob: wss://example.com; script-src 'self'; child-src 'self'; worker-src 'self';";
+
   # Fallback route.
   # Try static files, then fall back to the SPA.
   location / {