LotusGuild/matrix

cinny CSP: allow the Kuma status page (cinny #124) #16

Merged

jared merged 1 commits from csp-kuma-status into main

2026-09-29 12:28:31 -04:00

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	9fcbd410f2	cinny CSP: allow the app to read the Kuma status page (cinny #124 ) Lint / Shell (shellcheck) (push) Successful in 17s Details Lint / JS (eslint) (push) Successful in 12s Details Lint / No secrets in webhook configs (push) Successful in 7s Details Lint / Landing page is rendered (matrix (push) Successful in 7s Details Lint / Python (ruff) (push) Successful in 7s Details Lint / Python deps (pip-audit) (push) Successful in 45s Details Lint / Secret scan (gitleaks) (push) Successful in 7s Details Lint / Shell (shellcheck) (pull_request) Successful in 12s Details Lint / JS (eslint) (pull_request) Successful in 11s Details Lint / No secrets in webhook configs (pull_request) Successful in 7s Details Lint / Landing page is rendered (matrix (pull_request) Successful in 10s Details Lint / Python (ruff) (pull_request) Successful in 8s Details Lint / Python deps (pip-audit) (pull_request) Successful in 57s Details Lint / Secret scan (gitleaks) (pull_request) Successful in 8s Details Add https://isitup.lotusguild.org to connect-src so the client can fetch the public status JSON (GET /api/status-page/matrix and /api/status-page/heartbeat/matrix) for the homeserver status banner. Read-only public JSON, no credentials; nothing else changes. The live snippet (/etc/nginx/snippets/cinny-security-headers.conf on LXC 106) was identical to this file before the change; install it by hand with a backup and `nginx -t` (the deploy script only handles cinny/nginx.conf). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 12:08:45 -04:00