# Headers for the bundled Element Call page (/public/element-call/).
# Same as cinny-security-headers.conf minus the Content-Security-Policy: the app
# embeds this page in an iframe, and the app CSP's frame-ancestors 'none' (plus a
# connect-src that doesn't list the call backends) blocked it. X-Frame-Options
# SAMEORIGIN still limits framing to chat.lotusguild.org itself.
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy strict-origin-when-cross-origin always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header Permissions-Policy "accelerometer=(), autoplay=(self), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(self), midi=(), payment=(), usb=()" always;