From 6b29f46f3b77bd2c899e039ea41e76840212e83a Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 5 Jul 2026 15:14:26 +0000 Subject: [PATCH] fix(opencloud): add CSP config to allow Pocket ID OIDC auth Browser was blocking fetch of https://auth.basicstack.de/.well-known/openid-configuration due to missing connect-src directive in Content-Security-Policy. Adds csp.yaml to the ConfigMap (mounted at /etc/opencloud/csp.yaml) with extended connect-src that includes auth.basicstack.de and WebSocket origins. Sets PROXY_CSP_CONFIG_FILE_LOCATION env var so the proxy service picks it up. Co-Authored-By: Paperclip --- apps/opencloud/opencloud-configmap.yaml | 12 ++++++++++++ apps/opencloud/opencloud-deployment.yaml | 2 ++ 2 files changed, 14 insertions(+) diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml index d090fa9..38642e5 100644 --- a/apps/opencloud/opencloud-configmap.yaml +++ b/apps/opencloud/opencloud-configmap.yaml @@ -60,3 +60,15 @@ data: gateway: storage_registry: storage_users_mount_id: ${OC_STORAGE_MOUNT_ID} + + csp.yaml: | + directives: + connect-src: + - "'self'" + - "blob:" + - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/" + - "https://update.opencloud.eu/" + - "https://opencloud.basicstack.de" + - "https://auth.basicstack.de" + - "wss://opencloud.basicstack.de" + - "wss://auth.basicstack.de" diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml index 40e1c03..50c18b5 100644 --- a/apps/opencloud/opencloud-deployment.yaml +++ b/apps/opencloud/opencloud-deployment.yaml @@ -165,6 +165,8 @@ spec: value: "openid profile email groups" # Proxy service OIDC configuration + - name: PROXY_CSP_CONFIG_FILE_LOCATION + value: "/etc/opencloud/csp.yaml" - name: PROXY_OIDC_ISSUER value: "https://auth.basicstack.de" - name: PROXY_OIDC_REWRITE_WELLKNOWN