From 55ee036fd7ebed24097c8da1ca8a0b0829264670 Mon Sep 17 00:00:00 2001 From: Emile Date: Sat, 9 Mar 2024 22:56:01 +0100 Subject: big bang --- nix/hosts/corrino/www/cs.emile.space.nix | 56 +++ nix/hosts/corrino/www/ctf.emile.space.nix | 26 ++ nix/hosts/corrino/www/emile.space.nix | 60 +++ nix/hosts/corrino/www/events.emile.space.nix | 59 +++ nix/hosts/corrino/www/git.emile.space.nix | 73 ++++ nix/hosts/corrino/www/grafana.emile.space.nix | 217 ++++++++++ nix/hosts/corrino/www/grafana_full.emile.space.nix | 440 +++++++++++++++++++++ nix/hosts/corrino/www/hydra.emile.space.nix | 57 +++ nix/hosts/corrino/www/jupyter.emile.space.nix | 60 +++ nix/hosts/corrino/www/magic-hash.emile.space.nix | 33 ++ nix/hosts/corrino/www/netbox.emile.space.nix | 63 +++ nix/hosts/corrino/www/pgweb.emile.space.nix | 21 + nix/hosts/corrino/www/photo.emile.space.nix | 33 ++ nix/hosts/corrino/www/stream.emile.space.nix | 24 ++ nix/hosts/corrino/www/talks.emile.space.nix | 97 +++++ nix/hosts/corrino/www/tickets.emile.space.nix | 120 ++++++ .../www/tickets.emile.space.nix_chaos.jetzt.nix | 107 +++++ nix/hosts/corrino/www/znc.emile.space.nix | 47 +++ 18 files changed, 1593 insertions(+) create mode 100644 nix/hosts/corrino/www/cs.emile.space.nix create mode 100644 nix/hosts/corrino/www/ctf.emile.space.nix create mode 100644 nix/hosts/corrino/www/emile.space.nix create mode 100644 nix/hosts/corrino/www/events.emile.space.nix create mode 100644 nix/hosts/corrino/www/git.emile.space.nix create mode 100644 nix/hosts/corrino/www/grafana.emile.space.nix create mode 100644 nix/hosts/corrino/www/grafana_full.emile.space.nix create mode 100644 nix/hosts/corrino/www/hydra.emile.space.nix create mode 100644 nix/hosts/corrino/www/jupyter.emile.space.nix create mode 100644 nix/hosts/corrino/www/magic-hash.emile.space.nix create mode 100644 nix/hosts/corrino/www/netbox.emile.space.nix create mode 100644 nix/hosts/corrino/www/pgweb.emile.space.nix create mode 100644 nix/hosts/corrino/www/photo.emile.space.nix create mode 100644 nix/hosts/corrino/www/stream.emile.space.nix create mode 100644 nix/hosts/corrino/www/talks.emile.space.nix create mode 100644 nix/hosts/corrino/www/tickets.emile.space.nix create mode 100644 nix/hosts/corrino/www/tickets.emile.space.nix_chaos.jetzt.nix create mode 100644 nix/hosts/corrino/www/znc.emile.space.nix (limited to 'nix/hosts/corrino/www') diff --git a/nix/hosts/corrino/www/cs.emile.space.nix b/nix/hosts/corrino/www/cs.emile.space.nix new file mode 100644 index 0000000..de4d67e --- /dev/null +++ b/nix/hosts/corrino/www/cs.emile.space.nix @@ -0,0 +1,56 @@ +# Run sourcegraph, including its entire machinery, in a container. +# Running it outside of a container is a futile endeavour for now. + +# adapted from https://cs.tvl.fyi/depot/-/blob/ops/modules/sourcegraph.nix + +{ ... }: + +{ + services.nginx.virtualHosts."cs.emile.space" = { + forceSSL = true; + enableACME = true; + + locations = { + "/" = { + proxyPass = "http://127.0.0.1:3463"; + + extraConfig = '' + location = / { + return 301 https://cs.emile.space/hefe; + } + + location / { + proxy_set_header X-Sg-Auth "Anonymous"; + proxy_pass http://localhost:7080; + } + + location /users/Anonymous/settings { + return 301 https://cs.emile.space; + } + ''; + }; + }; + }; + + virtualisation.oci-containers.backend = "docker"; + virtualisation.oci-containers.containers.sourcegraph = { + image = "sourcegraph/server:5.1.1"; + + ports = [ + "127.0.0.1:3463:7080" + ]; + + volumes = [ + "/var/lib/sourcegraph/etc:/etc/sourcegraph" + "/var/lib/sourcegraph/data:/var/opt/sourcegraph" + ]; + + # Sourcegraph needs a higher nofile limit, it logs warnings + # otherwise (unclear whether it actually affects the service). + extraOptions = [ + "--ulimit" + "nofile=10000:10000" + ]; + }; +} + diff --git a/nix/hosts/corrino/www/ctf.emile.space.nix b/nix/hosts/corrino/www/ctf.emile.space.nix new file mode 100644 index 0000000..c4de8c5 --- /dev/null +++ b/nix/hosts/corrino/www/ctf.emile.space.nix @@ -0,0 +1,26 @@ +{ ... }: + +{ + services.nginx.virtualHosts."ctf.emile.space" = { + forceSSL = true; + enableACME = true; + + locations = { + "/" = { + proxyPass = "http://127.0.0.1:8338"; + }; + }; + }; + + virtualisation.oci-containers = { + backend = "docker"; + containers = { + "ctfd" = { + image = "ctfd/ctfd"; + ports = [ + "8338:8000" + ]; + }; + }; + }; +} diff --git a/nix/hosts/corrino/www/emile.space.nix b/nix/hosts/corrino/www/emile.space.nix new file mode 100644 index 0000000..9cca880 --- /dev/null +++ b/nix/hosts/corrino/www/emile.space.nix @@ -0,0 +1,60 @@ +{ + services.nginx.virtualHosts."emile.space" = { + forceSSL = true; + enableACME = true; + + # kTLS = true; + + locations = { + "/" = { + root = "/var/www/emile.space"; + extraConfig = '' + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + ''; + }; + + #"/.well-known" = { + # root = "/var/www/emile.space"; + # extraConfig = '' + # autoindex on; + # ''; + #}; + + ## I ran a matrix homeserver for some time, then stopped, but the other + ## homeserver don't know and don't stop sending me requests (5e5 a day or + ## so). + #"/.well-known/matrix/server".extraConfig = '' + # return 410; + #''; + }; + }; + + # services.stargazer = { + # enable = true; + # user = "stargazer"; + # group = "stargazer"; + + # certLifetime = "1m"; + # store = /var/lib/gemini/certs; + + # genCerts = true; + # regenCerts = true; + # responseTimeout = 0; + # requestTimeout = 5; + + # routes = [ + # { + # route = "emile.space"; + # root = "/srv/gemini/emile.space"; + # } + # ]; + + # listen = [ "0.0.0.0" "[2002:a00:1::]" ]; + + # ipLogPartial = false; + # ipLog = false; + # connectionLogging = false; + + # certOrg = "emile.space"; + # }; +} diff --git a/nix/hosts/corrino/www/events.emile.space.nix b/nix/hosts/corrino/www/events.emile.space.nix new file mode 100644 index 0000000..bb4db38 --- /dev/null +++ b/nix/hosts/corrino/www/events.emile.space.nix @@ -0,0 +1,59 @@ +{ ... }: + +{ + services.nginx.virtualHosts."events.emile.space" = { + forceSSL = true; + enableACME = true; + + locations = { + "/" = { + extraConfig = '' + proxy_pass http://[::1]:4000; + ''; + }; + }; + }; + + # Create users: + # + # go into the mobilizon-launchers directory within the nix store (systemctl + # status mobilizon..., you'll find it there somehow) + # + # ; sudo -u mobilizon ./bin/mobilizon_ctl users.new emile@emile.space --moderator --admin + + services = { + mobilizon = { + enable = true; + settings.":mobilizon" = { + "Mobilizon.Web.Endpoint" = { + url.host = "events.emile.space"; + http.port = 4000; + + # The IP address to listen on. Defaults to [::1] notated as a byte + # tuple. + # (Yes, this is an elexir application and they've mapped the type system + # into nix) + http.ip = { + _elixirType = "tuple"; + value = [ 0 0 0 0 0 0 0 1 ]; + }; + + has_reverse_proxy = true; + }; + + "Mobilizon.Storage.Repo" = { + username = "mobilizon"; + socket_dir = "/var/run/postgresql"; + database = "mobilizon_prod"; + }; + + ":instance" = rec { + name = "events.emile.space"; + hostname = "emile.space"; + email_reply_to = email_from; + email_from = "noreply@$emile.space"; + }; + }; + }; + }; +} diff --git a/nix/hosts/corrino/www/git.emile.space.nix b/nix/hosts/corrino/www/git.emile.space.nix new file mode 100644 index 0000000..2c7d64e --- /dev/null +++ b/nix/hosts/corrino/www/git.emile.space.nix @@ -0,0 +1,73 @@ +{ pkgs, config, ... }: + +let + cfg = config.services.gitea; +in { + services.nginx.virtualHosts."git.emile.space" = { + forceSSL = true; + enableACME = true; + + locations = { + "/" = { + proxyPass = "http://127.0.0.1:3000"; + }; + }; + }; + + services.gitea = rec { + enable = true; + + appName = "git.emile.space"; + + # unstable in order to use the 1.20... version + #package = pkgs.forgejo; + package = pkgs.unstable.forgejo; + + stateDir = "/var/lib/gitea"; + repositoryRoot = "${stateDir}/repositories"; + + settings = { + service.DISABLE_REGISTRATION = true; + + DEFAULT = { + WORK_PATH = "/var/lib/gitea"; + }; + + server = { + DOMAIN = pkgs.lib.mkForce "git.emile.space"; + ROOT_URL = pkgs.lib.mkForce "https://git.emile.space"; + + #START_SSH_SERVER = true; + BUILTIN_SSH_SERVER_USER = "git"; + SSH_USER = "gitea"; + SSH_DOMAIN = "git.emile.space"; + + REPO_INDEXER_ENABLED = true; + }; + + indexer = { + REPO_INDEXER_ENABLED = true; + ISSUE_INDEXER_PATH = "${stateDir}/indexers/issues.bleve"; + REPO_INDEXER_PATH = "${stateDir}/indexers/repos.bleve"; + MAX_FILE_SIZE = 1048576; + REPO_INDEXER_INCLUDE = ""; + REPO_INDEXER_EXCLUDE = "resources/bin/**"; + }; + + #federation = { + # enable = true; + # share_user_statistics = true; + # max_size = 4; + #}; + }; + }; + + users.users.git = { + isSystemUser = true; + useDefaultShell = true; + group = "git"; + extraGroups = [ "gitea" ]; + home = cfg.stateDir; + }; + users.groups.git = { }; +} diff --git a/nix/hosts/corrino/www/grafana.emile.space.nix b/nix/hosts/corrino/www/grafana.emile.space.nix new file mode 100644 index 0000000..0f73147 --- /dev/null +++ b/nix/hosts/corrino/www/grafana.emile.space.nix @@ -0,0 +1,217 @@ +{ config, ... }: + +{ + services = { + nginx.virtualHosts."grafana.emile.space" = { + addSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}/"; + proxyWebsockets = true; + }; + }; + + grafana = { + enable = true; + settings = { + server = { + http_addr = "127.0.0.1"; + http_port = 3002; + domain = "grafana.emile.space"; + root_url = "https://grafana.emile.space/"; + }; + }; + + provision = { + datasources = { + settings = { + datasources = [ + { + url = "http://localhost:${toString config.services.prometheus.port}"; + type = "prometheus"; + name = "Prometheus"; + editable = false; + access = "proxy"; # server = "proxy", browser = "direct" + } + { + name = "loki"; + url = "http://localhost:${toString config.services.loki.configuration.server.http_listen_port}"; + type = "loki"; + } + ]; + }; + }; + }; + }; + + prometheus = { + enable = true; + retentionTime = "356d"; + port = 9003; + + exporters = { + node = { + enable = true; + enabledCollectors = [ "systemd" ]; + port = 9002; + }; + }; + scrapeConfigs = [ + { + job_name = "corrino"; + static_configs = [{ + targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; + }]; + } + ]; + }; + + loki = { + enable = true; + configuration = { + auth_enabled = false; + server = { + http_listen_port = 9004; + }; + + limits_config = { + reject_old_samples = true; + reject_old_samples_max_age = "7d"; + max_global_streams_per_user = 100000; + }; + + common = { + instance_addr = "127.0.0.1"; + ring = { + instance_addr = "127.0.0.1"; + kvstore.store = "inmemory"; + }; + replication_factor = 1; + path_prefix = "/tmp/loki"; + }; + + schema_config.configs = [{ + from = "2023-05-09"; + store = "boltdb-shipper"; + object_store = "filesystem"; + schema = "v11"; + index = { + prefix = "index_"; + period = "24h"; + }; + }]; + }; + }; + }; + + # allow the promtail user to read the nginx access files + users.users.promtail.extraGroups = [ "nginx" ]; + + services = { + promtail = { + enable = true; + configuration = { + server = { + http_listen_port = 9005; + grpc_listen_port = 0; + }; + positions.filename = "/tmp/positions.yml"; + clients = [{ + url = "http://localhost:${toString config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push"; + }]; + scrape_configs = [ + + # systemd + { + job_name = "journal"; + journal = { + max_age = "12h"; + labels = { + job = "systemd-journal"; + host = config.networking.hostName; + }; + }; + relabel_configs = [ + { + source_labels = [ "__journal__systemd_unit" ]; + target_label = "unit"; + } + ]; + } + + # nginx error log + { + job_name = "nginx-error-logs"; + static_configs = [{ + targets = [ "localhost" ]; + labels = { + job = "nginx-error-logs"; + host = "corrino"; + __path__ = "/var/log/nginx/*error.log"; + }; + }]; + } + + # nginx + { + job_name = "nginx"; + static_configs = [ + { + targets = [ "localhost" ]; + labels = { + job = "nginx"; + host = "corrino"; + __path__ = "/var/log/nginx/*access.log"; + }; + } + ]; + pipeline_stages = [ + # { + # regex = { + # expression = "(?:[0-9]{1,3}\.){3}([0-9]{1,3})"; + # replace = "***"; + # }; + # } + { + regex = { + expression = ''(?P.+) - - \[(?P.+)\] "(?P.+) (?P.+) (HTTP\/(?P\d.\d))" (?P\d{3}) (?P\d+) (["](?P(\-)|(.+))["]) (["](?P.+)["])''; + }; + } + { + labels = { + remote_addr = null; + time_local = null; + method = null; + url = null; + status = null; + body_bytes_sent = null; + http_referer = null; + http_user_agent = null; + }; + } + # { + # timestamp = { + # source = "time_local"; + # format = "02/Jan/2006:15:04:05 -0700"; + # }; + # } + { + drop = { + source = "url"; + expression = ''/(_matrix|.well-known|notifications|api|identity).*''; + }; + } + { + drop = { + source = "url"; + expression = ''grafana.*''; + }; + } + ]; + } + + ]; + }; + }; + }; +} \ No newline at end of file diff --git a/nix/hosts/corrino/www/grafana_full.emile.space.nix b/nix/hosts/corrino/www/grafana_full.emile.space.nix new file mode 100644 index 0000000..8a9aa02 --- /dev/null +++ b/nix/hosts/corrino/www/grafana_full.emile.space.nix @@ -0,0 +1,440 @@ +{ pkgs, config, ... }: + +let + cfg = config.services.grafana; +in { + services.nginx.virtualHosts."git.emile.space" = { + forceSSL = true; + enableACME = true; + + locations = { + "/" = { + proxyPass = "http://127.0.0.1:3000"; + }; + }; + }; + + services = { + grafana = { + enable = true; + package = pkgs.grafana; + #declarativePlugins = with pkgs.grafanaPlugins; [ + # grafana-piechart-panel + #]; + dataDir = "/var/lib/grafana"; + + settings = { + users = { + # Viewers can access and use Explore and perform temporary edits on panels in dashboards they have access to. They cannot save their changes. + viewers_can_edit = true; + + # Require email validation before sign up completes + verify_email_enabled = false; + + # The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). The minimum supported duration is 15m (15 minutes). + user_invite_max_lifetime_duration = "24h"; + + # Text used as placeholder text on login page for password input. + password_hint = "password"; + + # Text used as placeholder text on login page for login/username input. + login_hint = "email or username"; + + # Path to a custom home page. Users are only redirected to this if the default home dashboard is used. It should match a frontend route and contain a leading slash. + home_page = ""; + + # This is a comma-separated list of usernames. Users specified here are hidden in the Grafana UI. They are still visible to Grafana administrators and to themselves. + hidden_users = ""; + + # Editors can administrate dashboards, folders and teams they create. + editors_can_admin = false; + + # Sets the default UI theme. system matches the user’s system theme. + default_theme = "system"; + + # This setting configures the default UI language, which must be a supported IETF language tag, such as en-US. + default_language = "en-US"; + + # The role new users will be assigned for the main organization (if the auto_assign_org setting is set to true). + # one of "Viewer", "Editor", "Admin" + auto_assign_org_role = "Viewer"; + + # Set this value to automatically add new users to the provided org. This requires auto_assign_org to be set to true. Please make sure that this organization already exists. + auto_assign_org_id = 1; + + # Set to true to automatically add new users to the main organization (id 1). When set to false, new users automatically cause a new organization to be created for that new user. The organization will be created even if the allow_org_create setting is set to false. + auto_assign_org = true; + + # Set to false to prohibit users from being able to sign up / create user accounts. The admin user can still create users. + allow_sign_up = false; + + # Set to false to prohibit users from creating new organizations. + allow_org_create = false; + }; + + smtp = { + # User used for authentication. + user = "mail"; + + # StartTLS policy when connecting to server. + # null or one of "OpportunisticStartTLS", "MandatoryStartTLS", "NoStartTLS" + startTLS_policy = null; + + # Verify SSL for SMTP server. + skip_verify = false; + + # Password used for authentication. Please note that the contents of this option will end up in a world-readable Nix store. Use the file provider pointing at a reasonably secured file in the local filesystem to work around that. Look at the documentation for details: https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider + password = ""; + + # File path to a key file. + key_file = "$__file{${config.age.secrets.grafana_smtp_password.path}}"; + + # Host to connect to. + host = "localhost:25"; + + # Name to be used as client identity for EHLO in SMTP dialog. + from_name = "Grafana"; + + # Address used when sending out emails + from_address = "admin@grafana.localhost"; + + # Whether to enable SMTP + enabled = true; + + # Name to be used as client identity for EHLO in SMTP dialog + ehlo_identity = null; + + # File path to a cert file + cert_file = null; + }; + server = { + # Root path for static assets. + #static_root_path = "${package}/share/grafana/public"; + + # Mode where the socket should be set when protocol=socket. Make sure that Grafana process is the file owner before you change this setting. + socket_mode = "0660"; + + # GID where the socket should be set when protocol=socket. Make sure that the target group is in the group of Grafana process and that Grafana process is the file owner before you change this setting. It is recommended to set the gid as http server user gid. Not set when the value is -1. + socket_gid = -1; + + # Path where the socket should be created when protocol=socket. Make sure that Grafana has appropriate permissions before you change this setting. + socket = "/run/grafana/grafana.sock"; + + # Serve Grafana from subpath specified in the root_url setting. By default it is set to false for compatibility reasons. + # + # By enabling this setting and using a subpath in root_url above, e.g. root_url = "http://localhost:3000/grafana", Grafana is accessible on http://localhost:3000/grafana. If accessed without subpath, Grafana will redirect to an URL with the subpath. + serve_from_sub_path = false; + + # Set to true for Grafana to log all HTTP requests (not just errors). These are logged as Info level events to the Grafana log. + router_logging = false; + + # This is the full URL used to access Grafana from a web browser. This is important if you use Google or GitHub OAuth authentication (for the callback URL to be correct). + # + # This setting is also important if you have a reverse proxy in front of Grafana that exposes it through a subpath. In that case add the subpath to the end of this URL setting. + root_url = "%(protocol)s://%(domain)s:%(http_port)s/"; + + # Sets the maximum time using a duration format (5s/5m/5ms) before timing out read of an incoming request and closing idle connections. 0 means there is no timeout for reading the request. + read_timeout = 0; + + # Which protocol to listen. + # one of "http", "https", "h2", "socket" + protocol = "http"; + + # Listening port. + http_port = "3000"; + + # Listening address. + # This setting intentionally varies from upstream’s default to be a bit more secure by default. + http_addr = "127.0.0.1"; + + # Redirect to correct domain if the host header does not match the domain. Prevents DNS rebinding attacks. + enforce_domain = true; + + # Set this option to true to enable HTTP compression, this can improve transfer speed and bandwidth utilization. It is recommended that most users set it to true. By default it is set to false for compatibility reasons. + enable_gzip = true; + + # The public facing domain name used to access grafana from a browser. + # This setting is only used in the default value of the root_url setting. If you set the latter manually, this option does not have to be specified. + domain = "grafana.emile.space"; + + # Path to the certificate key file (if protocol is set to https or h2). + cert_key = null; + + # Path to the certificate file (if protocol is set to https or h2). + cert_file = null; + + # Specify a full HTTP URL address to the root of your Grafana CDN assets. Grafana will add edition and version paths. + # + # For example, given a cdn url like https://cdn.myserver.com grafana will try to load a javascript file from http://cdn.myserver.com/grafana-oss/7.4.0/public/build/app..js. + cdn_url = null; + }; + + security = { + # Set to false to disable the X-XSS-Protection header, which tells browsers to stop pages from loading when they detect reflected cross-site scripting (XSS) attacks. + x_xss_protection = true; + + # Set to false to disable the X-Content-Type-Options response header. The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. + x_content_type_options = true; + + # Set to true to enable HSTS includeSubDomains option. Only applied if strict_transport_security is enabled. + strict_transport_security_subdomains = true; + + # Set to true to enable HSTS preloading option. Only applied if strict_transport_security is enabled. + strict_transport_security_preload = true; + + # Sets how long a browser should cache HSTS in seconds. Only applied if strict_transport_security is enabled. + strict_transport_security_max_age_seconds = 86400; + + # Set to true if you want to enable HTTP Strict-Transport-Security (HSTS) response header. Only use this when HTTPS is enabled in your configuration, or when there is another upstream system that ensures your application does HTTPS (like a frontend load balancer). HSTS tells browsers that the site should only be accessed using HTTPS. + strict_transport_security = true; + + # Secret key used for signing. Please note that the contents of this option will end up in a world-readable Nix store. Use the file provider pointing at a reasonably secured file in the local filesystem to work around that. Look at the documentation for details: https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider + secret_key = "$__file{${config.age.secrets.grafana_secret_key.path}}"; + + # Disable creation of admin user on first start of Grafana. + disable_initial_admin_creation = false; + + # Set to true to disable the use of Gravatar for user profile images. + disable_gravatar = false; + + # Set to true to disable brute force login protection. + disable_brute_force_login_protection = false; + + # Define a whitelist of allowed IP addresses or domains, with ports, to be used in data source URLs with the Grafana data source proxy. Format: ip_or_domain:port separated by spaces. PostgreSQL, MySQL, and MSSQL data sources do not use the proxy and are therefore unaffected by this setting. + data_source_proxy_whitelist = []; + + # List of additional allowed URLs to pass by the CSRF check. Suggested when authentication comes from an IdP. + csrf_trusted_origins = []; + + # List of allowed headers to be set by the user. Suggested to use for if authentication lives behind reverse proxies. + csrf_additional_headers = []; + + # Set to true if you host Grafana behind HTTPS. + cookie_secure = true; + + # Sets the SameSite cookie attribute and prevents the browser from sending this cookie along with cross-site requests. The main goal is to mitigate the risk of cross-origin information leakage. This setting also provides some protection against cross-site request forgery attacks (CSRF), read more about SameSite here. Using value disabled does not add any SameSite attribute to cookies. + # one of "lax", "strict", "none", "disabled" + cookie_samesite = "strict"; + + # Set to true to add the Content-Security-Policy-Report-Only header to your requests. CSP in Report Only mode enables you to experiment with policies by monitoring their effects without enforcing them. You can enable both policies simultaneously. + content_security_policy_report_only = false; + + # Set to true to add the Content-Security-Policy header to your requests. CSP allows to control resources that the user agent can load and helps prevent XSS attacks. + content_security_policy = true; + + # When false, the HTTP header X-Frame-Options: deny will be set in Grafana HTTP responses which will instruct browsers to not allow rendering Grafana in a ,