---
flags:
  style-src-attr:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  script-src-elem:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
whitelist:
  connect-src:
    - "*.{{ DOMAIN_PRIMARY }}"
    - "{{ DOMAIN_PRIMARY }}"
    - https://cdn.jsdelivr.net # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
  script-src-elem:
    - https://cdn.jsdelivr.net # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
  style-src-elem:
    - https://cdn.jsdelivr.net # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
  frame-ancestors:
    - "{{ lookup('domain', 'web-app-keycloak') }}"