Configurable Extra connect-src CSP Origins

[takwerx]

Problem

The plugin system makes it easy to build frontend plugins that consume an external data feed — but the nginx CSP is fixed at connect-src 'self' (plus the API host), so any browser fetch/WebSocket to a third-party origin is blocked by the page's CSP in production. The only workaround today is forking/patching api/nginx.conf.js in the image.

Concrete case: a community lightning plugin (Blitzortung websocket feed, wss://ws*.blitzortung.org) works on a dev build but its socket is CSP-refused on any deployed instance.

Change

nginx.conf.js accepts an optional space-separated CSP_CONNECT_SRC env var whose entries are appended to connect-src. Entries are validated against a conservative character allowlist ([A-Za-z0-9*.:/-]) so a malformed value cannot break out of the quoted header — invalid entries are logged to stderr and skipped.

No behavior change when the variable is unset — the generated config is identical to before.

Testing

$ API_URL=https://map.example.com CSP_CONNECT_SRC='wss://ws1.blitzortung.org wss://*.blitzortung.org bad;value' node nginx.conf.js | grep -o "connect-src[^;]*" | head -1
connect-src 'self' wss://ws1.blitzortung.org wss://*.blitzortung.org map.example.com:* *.example.com:*
# stderr: CSP_CONNECT_SRC: ignoring invalid source "bad;value"

$ API_URL=https://map.example.com node nginx.conf.js | grep -o "connect-src[^;]*" | head -1
connect-src 'self' map.example.com:* *.example.com:*

🤖 Generated with Claude Code