Set basic security hardening

Serving a more locked-down CSP is blocked by gitweb inlining JS, will need some workaround to insert SRI checks.

diff --git a/etc/caddy/Caddyfile b/etc/caddy/Caddyfile
index 35d763d186f1c396092f890a884afe3806bd34e5..e659f8628701e09ebbc8289e0fb9edde4b81b178 100644 (file)
--- a/etc/caddy/Caddyfile
+++ b/etc/caddy/Caddyfile
@@ -1,4 +1,9 @@
 git.ardis.lu {
+  header {
+    Content-Security-Policy "object-src 'none'; base-uri 'self'; frame-ancestors 'none';"
+    X-Content-Type-Options nosniff
+  }
+
   root /usr/share/gitweb
   encode
   file_server