From: Ardis Lu <ardisglu@gmail.com>
Date: Sun, 14 Sep 2025 23:43:36 +0000 (-0700)
Subject: Set basic security hardening
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=812e2cbcfe677007e32b388f1696c2ea3de069c9;p=git.ardis.lu

Set basic security hardening

Serving a more locked-down CSP is blocked by gitweb inlining JS, will need some workaround to insert SRI checks.
---

diff --git a/etc/caddy/Caddyfile b/etc/caddy/Caddyfile
index 35d763d..e659f86 100644
--- a/etc/caddy/Caddyfile
+++ b/etc/caddy/Caddyfile
@@ -1,4 +1,9 @@
 git.ardis.lu {
+  header {
+    Content-Security-Policy "object-src 'none'; base-uri 'self'; frame-ancestors 'none';"
+    X-Content-Type-Options nosniff
+  }
+
   root /usr/share/gitweb
   encode
   file_server