From f0965719ee355da55fa40c1642898929040ccd75 Mon Sep 17 00:00:00 2001
From: Jonah Aragon <jonah@triplebit.net>
Date: Wed, 2 Oct 2019 22:39:43 -0500
Subject: [PATCH] Re-add CSP

---
 nginx/010-headers.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nginx/010-headers.conf b/nginx/010-headers.conf
index 758eb41c..1053c4dd 100644
--- a/nginx/010-headers.conf
+++ b/nginx/010-headers.conf
@@ -1,6 +1,7 @@
 add_header X-Frame-Options DENY always;
 add_header X-XSS-Protection "1; mode=block" always;
 add_header X-Content-Type-Options nosniff always;
+add_header Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' https://stats.privacytools.io; style-src 'self' 'unsafe-inline'; img-src *; object-src 'none'; frame-src https://stats.privacytools.io; font-src 'self'; manifest-src 'self';" always;
 add_header Strict-Transport-Security "max-age=31557600; includeSubDomains; preload";
 add_header 'Access-Control-Allow-Origin' '*';
 add_header Alt-Svc 'h2="privacy2zbidut4m4jyj3ksdqidzkw3uoip2vhvhbvwxbqux5xy5obyd.onion:443"; ma=86400; persist=1';