---
whitelist:
  connect-src: "{{ lookup('fediwall_active', 'url_bases') }}"
  img-src:
    - "http:"
    - "https:"
    - "data:"
  media-src:
    - "http:"
    - "https:"
    - "data:"
flags:
  style-src-attr:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  script-src-elem:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  script-src-attr:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface