cryptpad_ynh/conf/nginx.conf

location / {
	if ($args ~ ver=) {
        set $cacheControl max-age=31536000;
        }
        # Will not set any header if it is emptystring
        add_header Cache-Control $cacheControl;
	
	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Content-Type-Options nosniff;
        # add_header X-Frame-Options "SAMEORIGIN";
	if ($scheme = http) {
		rewrite ^ https://$server_name$request_uri? permanent;
	}
		
	set $styleSrc   "'unsafe-inline' 'self'";
        set $scriptSrc  "'self'";
        set $connectSrc "'self' wss://cryptpad.fr wss://api.cryptpad.fr";
        set $fontSrc    "'self'";
        set $imgSrc     "data: *";
        set $frameSrc   "'self' beta.cryptpad.fr";

        if ($uri = /pad/inner.html) {
           set $scriptSrc "'self' 'unsafe-eval' 'unsafe-inline'";
        }
        add_header Content-Security-Policy "default-src 'none'; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc;";

        location = /cryptpad_websocket {
        proxy_pass    http://localhost:__PORT__/;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

#       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        # WebSocket support (nginx 1.4)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
        }

        location ^~ /customize.dist/ {
           # This is needed in order to prevent infinite recursion between /customize/ and the root
         }
        location ^~ /customize/ {
            rewrite ^/customize/(.*)$ $1 break;
            try_files /customize/$uri /customize.dist/$uri;
        }
        location = /api/config {
            default_type text/javascript;
            rewrite ^.*$ /customize/api/config break;
        }

        ## TODO fix in the code so that we don't need this
        location ~ ^/(register|login|settings|user|pad|drive|poll|slide|code|whiteboard)$ {
            rewrite ^(.*)$ $1/ redirect;
        }

        try_files /www/$uri /www/$uri/index.html /customize/$uri;

	# Include SSOWAT user panel.
	include conf.d/yunohost_panel.conf.inc;
}