Fixed the analytics and security headers for the Website service target.

2026-08-20 00:55:09 +02:00
parent 5422c8466d
commit b6ad9ff497
3 changed files with 42 additions and 4 deletions
@@ -20,6 +20,9 @@ services:
      LOG_LEVEL: ${LOG_LEVEL:-info}
      HTTP_SERVER_NAME: ${HTTP_SERVER_NAME:-SiteWebsite}
      SECURITY_STRICT_TRANSPORT_SECURITY: "${SECURITY_STRICT_TRANSPORT_SECURITY:-max-age=31536000; includeSubDomains}"
+      # Falls back to the policy the app ships with; set it in `.env` to allow the analytics origin,
+      # which must match `String.Analytics.origin`.
+      SECURITY_CONTENT_SECURITY_POLICY: "${SECURITY_CONTENT_SECURITY_POLICY:-default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'}"
      # Persistence: a managed PostgreSQL database. Provide the password via the environment or a secret — never
      # commit it.
      DATABASE_DRIVER: ${DATABASE_DRIVER:-postgres}