From 812e2cbcfe677007e32b388f1696c2ea3de069c9 Mon Sep 17 00:00:00 2001
From: Ardis Lu <ardisglu@gmail.com>
Date: Sun, 14 Sep 2025 16:43:36 -0700
Subject: [PATCH] Set basic security hardening

Serving a more locked-down CSP is blocked by gitweb inlining JS, will need some workaround to insert SRI checks.
---
 etc/caddy/Caddyfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/etc/caddy/Caddyfile b/etc/caddy/Caddyfile
index 35d763d..e659f86 100644
--- a/etc/caddy/Caddyfile
+++ b/etc/caddy/Caddyfile
@@ -1,4 +1,9 @@
 git.ardis.lu {
+  header {
+    Content-Security-Policy "object-src 'none'; base-uri 'self'; frame-ancestors 'none';"
+    X-Content-Type-Options nosniff
+  }
+
   root /usr/share/gitweb
   encode
   file_server
-- 
2.47.3