HTTP header improvements (#294)

[akkoma] / docs / docs / installation / openbsd_en.md

diff --git a/docs/docs/installation/openbsd_en.md b/docs/docs/installation/openbsd_en.md
index c7e8cf0c09b3136eb31d2304448b737f7d19c863..9693467f281926a7a9603e3e52dc1c45be5c71cf 100644 (file)
--- a/docs/docs/installation/openbsd_en.md
+++ b/docs/docs/installation/openbsd_en.md
@@ -160,15 +160,14 @@ http protocol plerup { # Protocol for upstream akkoma server
        match request header append "X-Forwarded-For" value "$REMOTE_ADDR" # This two header and the next one are not strictly required by akkoma but adding them won't hurt
        match request header append "X-Forwarded-By" value "$SERVER_ADDR:$SERVER_PORT"
 
-       match response header append "X-XSS-Protection" value "1; mode=block"
+       match response header append "X-XSS-Protection" value "0"
        match response header append "X-Permitted-Cross-Domain-Policies" value "none"
        match response header append "X-Frame-Options" value "DENY"
        match response header append "X-Content-Type-Options" value "nosniff"
        match response header append "Referrer-Policy" value "same-origin"
-       match response header append "X-Download-Options" value "noopen"
-       match response header append "Content-Security-Policy" value "default-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://CHANGEME.tld; upgrade-insecure-requests;" # Modify "CHANGEME.tld" and set your instance's domain here
+       match response header append "Content-Security-Policy" value "default-src 'none'; base-uri 'none'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://CHANGEME.tld; upgrade-insecure-requests;" # Modify "CHANGEME.tld" and set your instance's domain here
        match request header append "Connection" value "upgrade"
-       #match response header append "Strict-Transport-Security" value "max-age=31536000; includeSubDomains" # Uncomment this only after you get HTTPS working.
+       #match response header append "Strict-Transport-Security" value "max-age=63072000; includeSubDomains; preload" # Uncomment this only after you get HTTPS working.
 
        # If you do not want remote frontends to be able to access your Akkoma backend server, comment these lines
        match response header append "Access-Control-Allow-Origin" value "*"
@@ -250,6 +249,8 @@ If your instance is up and running, you can create your first user with administ
 LC_ALL=en_US.UTF-8 MIX_ENV=prod mix pleroma.user new <username> <your@emailaddress> --admin
 ```
 
+{! installation/frontends.include !}
+
 #### Further reading
 
 {! installation/further_reading.include !}