akkoma_ynh/conf/nginx.conf

location / {

  # Standard nginx configuration
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_set_header Host $http_host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

  proxy_pass http://127.0.0.1:__PORT__;

  client_max_body_size 50M;

  more_set_headers "Access-Control-Allow-Origin : *";
  more_set_headers "Access-Control-Allow-Methods : POST, PUT, DELETE, GET, PATCH, OPTIONS";
  more_set_headers "Access-Control-Allow-Headers : Authorization, Content-Type, Idempotency-Key";
  more_set_headers "Access-Control-Expose-Headers : Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id";
  if ($request_method = OPTIONS) {
    return 204;
  }
  # stop removing lines here.

  more_set_headers "X-XSS-Protection : 1; mode=block";
  more_set_headers "X-Permitted-Cross-Domain-Policies : none";
  more_set_headers "X-Frame-Options : DENY";
  more_set_headers "X-Content-Type-Options : nosniff";
  more_set_headers "Referrer-Policy : same-origin";
  more_set_headers "X-Download-Options : noopen";
  # more_set_headers "Content-Security-Policy : default-src 'none'; base-uri 'self'; form-action *; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://__DOMAIN__; upgrade-insecure-requests;";

  # Uncomment this only after you get HTTPS working.
  # more_set_headers "Strict-Transport-Security : max-age=31536000; includeSubDomains";


  # Include SSOWAT user panel.
  include conf.d/yunohost_panel.conf.inc;
}

rewrite ^/proxy/(.*)/(.*)/.* /proxy/$1/$2 last;

location ~ ^/(media|proxy) {
  proxy_cache akkoma_media_cache;
  proxy_cache_key    $host$uri$is_args$args;
  proxy_http_version 1.1;
  proxy_cache_valid  200 206 301 304 1h;
  proxy_cache_lock on;
  proxy_ignore_client_abort on;
  proxy_buffering on;
  chunked_transfer_encoding on;
# added some stuff that seirdy said to add to make me bullet proof. B-) https://akkoma.dev/AkkomaGang/akkoma/issues/547#issuecomment-9261
  more_set_headers "Content-Security-Policy : script-src 'none'; default-src 'none'; upgrade-insecure-requests; base-uri 'none'; form-action 'none'; 'sandbox';";

  proxy_pass http://localhost:__PORT__;
}

location ~ ^/(proxy|media) {
    more_set_headers "Content-Security-Policy : default-src 'none'; upgrade-insecure-requests; sandbox;";
}