From 93078858c128ac6a3fca34a348b2f64ac638d347 Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Sun, 18 Oct 2026 02:37:16 -0400 Subject: [PATCH 1/3] fix(cinny-web): allow www.mozilla.org in connect-src so mozilla.org login can discover its homeserver (#21) mozilla.org/.well-known/matrix/client 301s to www.mozilla.org, which the CSP refused, so choosing mozilla.org always said "Failed to connect". Fixes #21 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- cinny/nginx-security-headers.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cinny/nginx-security-headers.conf b/cinny/nginx-security-headers.conf index 08bc217..046186f 100644 --- a/cinny/nginx-security-headers.conf +++ b/cinny/nginx-security-headers.conf @@ -12,4 +12,4 @@ add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy strict-origin-when-cross-origin always; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; add_header Permissions-Policy 'accelerometer=(), autoplay=(self "https://call.chat.lotusguild.org"), camera=(self "https://call.chat.lotusguild.org"), display-capture=(self "https://call.chat.lotusguild.org"), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(self "https://call.chat.lotusguild.org"), midi=(), payment=(), usb=()' always; -add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://matrix.lotusguild.org https://matrix.org https://*.matrix.org https://mozilla.org https://mozilla.modular.im https://drive.lotusguild.org https://media.giphy.com https://media0.giphy.com https://media1.giphy.com https://media2.giphy.com https://media3.giphy.com https://media4.giphy.com https://www.openstreetmap.org https://tile.openstreetmap.org; font-src 'self' data:; connect-src 'self' https://matrix.lotusguild.org wss://matrix.lotusguild.org https://isitup.lotusguild.org https://matrix.org https://*.matrix.org https://mozilla.org https://mozilla.modular.im https://chat.mozilla.org https://vector.im https://api.giphy.com https://*.giphy.com wss:; media-src 'self' https: blob:; frame-src 'self' https:; worker-src 'self' blob:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always; +add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://matrix.lotusguild.org https://matrix.org https://*.matrix.org https://mozilla.org https://mozilla.modular.im https://drive.lotusguild.org https://media.giphy.com https://media0.giphy.com https://media1.giphy.com https://media2.giphy.com https://media3.giphy.com https://media4.giphy.com https://www.openstreetmap.org https://tile.openstreetmap.org; font-src 'self' data:; connect-src 'self' https://matrix.lotusguild.org wss://matrix.lotusguild.org https://isitup.lotusguild.org https://matrix.org https://*.matrix.org https://mozilla.org https://mozilla.modular.im https://chat.mozilla.org https://www.mozilla.org https://vector.im https://api.giphy.com https://*.giphy.com wss:; media-src 'self' https: blob:; frame-src 'self' https:; worker-src 'self' blob:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always; -- 2.47.3 From be0ff3b854fe045149ea402212c09cd3ef843b10 Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Sun, 18 Oct 2026 02:37:16 -0400 Subject: [PATCH 2/3] fix(cinny-web): allow the TikTok oEmbed lookup in connect-src (#18) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TikTok short links (vm.tiktok.com/…, tiktok.com/t/…) resolve their video id via https://www.tiktok.com/oembed, which the CSP refused, so their cards always failed on the web. The player itself was already allowed (frame-src https:). Fixes #18 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- cinny/nginx-security-headers.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cinny/nginx-security-headers.conf b/cinny/nginx-security-headers.conf index 046186f..6c9bd43 100644 --- a/cinny/nginx-security-headers.conf +++ b/cinny/nginx-security-headers.conf @@ -12,4 +12,4 @@ add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy strict-origin-when-cross-origin always; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; add_header Permissions-Policy 'accelerometer=(), autoplay=(self "https://call.chat.lotusguild.org"), camera=(self "https://call.chat.lotusguild.org"), display-capture=(self "https://call.chat.lotusguild.org"), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(self "https://call.chat.lotusguild.org"), midi=(), payment=(), usb=()' always; -add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://matrix.lotusguild.org https://matrix.org https://*.matrix.org https://mozilla.org https://mozilla.modular.im https://drive.lotusguild.org https://media.giphy.com https://media0.giphy.com https://media1.giphy.com https://media2.giphy.com https://media3.giphy.com https://media4.giphy.com https://www.openstreetmap.org https://tile.openstreetmap.org; font-src 'self' data:; connect-src 'self' https://matrix.lotusguild.org wss://matrix.lotusguild.org https://isitup.lotusguild.org https://matrix.org https://*.matrix.org https://mozilla.org https://mozilla.modular.im https://chat.mozilla.org https://www.mozilla.org https://vector.im https://api.giphy.com https://*.giphy.com wss:; media-src 'self' https: blob:; frame-src 'self' https:; worker-src 'self' blob:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always; +add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://matrix.lotusguild.org https://matrix.org https://*.matrix.org https://mozilla.org https://mozilla.modular.im https://drive.lotusguild.org https://media.giphy.com https://media0.giphy.com https://media1.giphy.com https://media2.giphy.com https://media3.giphy.com https://media4.giphy.com https://www.openstreetmap.org https://tile.openstreetmap.org; font-src 'self' data:; connect-src 'self' https://matrix.lotusguild.org wss://matrix.lotusguild.org https://isitup.lotusguild.org https://matrix.org https://*.matrix.org https://mozilla.org https://mozilla.modular.im https://chat.mozilla.org https://www.mozilla.org https://vector.im https://api.giphy.com https://*.giphy.com https://www.tiktok.com wss:; media-src 'self' https: blob:; frame-src 'self' https:; worker-src 'self' blob:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always; -- 2.47.3 From 61ed3c64e36a078c3a95ff4950023c86848f790c Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Sun, 18 Oct 2026 02:37:16 -0400 Subject: [PATCH 3/3] feat(cinny-web): featured communities on Explore, matching the desktop app (#20) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit chat.lotusguild.org's config.json has never had featuredCommunities, so Explore → Featured was empty on the web while the desktop app showed the Lotus Guild space, Homelab, Jellyfin and matrixrooms.info. Add the same set (decided 2026-10-04). Fixes #20 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- cinny/config.json | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/cinny/config.json b/cinny/config.json index 5257ee8..8b3469d 100644 --- a/cinny/config.json +++ b/cinny/config.json @@ -8,9 +8,16 @@ "allowCustomHomeservers": false, "featuredCommunities": { "openAsDefault": false, - "spaces": [], - "rooms": [], - "servers": [] + "spaces": [ + "!-1ZBnAH-JiCOV8MGSKN77zDGTuI3pgSdy8Unu_DrDyc", + "#homelab:codestorm.net" + ], + "rooms": [ + "#jellyfin:matrix.org" + ], + "servers": [ + "matrixrooms.info" + ] }, "hashRouter": { "enabled": false, -- 2.47.3