33 lines
1.6 KiB
YAML
33 lines
1.6 KiB
YAML
# Traefik dynamic-config reference: the doxa-maps frame-policy split
|
|
# (documentation/architecture/embeddability.md). Adjust host/service names to your deploy.
|
|
# Direct-embed pages (>=2 path segments under the tree) must be framable anywhere;
|
|
# staging pages stay preview-only. frame-ancestors is header-only, so the proxy
|
|
# owns this — the bundler can only document and template it.
|
|
#
|
|
# CORS (added 2026-09-24): the WHOLE tree must send Access-Control-Allow-Origin, not only the
|
|
# embed pages. A composed surface (the cap-5 Research Gallery, cap-4 composites) mounted by
|
|
# <script> on a partner page fetch()es manifest.json at the tree ROOT and assets/ after it mounts,
|
|
# and fetch() enforces CORS. Measured live: manifest.json answered 200 with NO ACAO (it sits one
|
|
# segment deep, outside the embed-pages rule), so every gallery tab would fail on doxa.life.
|
|
http:
|
|
middlewares:
|
|
doxa-maps-cors:
|
|
headers:
|
|
accessControlAllowOriginList: ["*"]
|
|
accessControlAllowMethods: ["GET", "HEAD", "OPTIONS"]
|
|
doxa-maps-embed-framable:
|
|
headers:
|
|
customResponseHeaders:
|
|
Content-Security-Policy: "frame-ancestors *"
|
|
X-Frame-Options: ""
|
|
routers:
|
|
doxa-maps-embed-pages:
|
|
rule: "PathRegexp(`^/doxa-maps/[^/]+/[^/]+/`)"
|
|
priority: 70 # above the site catch-all
|
|
middlewares: [doxa-maps-embed-framable, doxa-maps-cors]
|
|
service: your-static-service
|
|
doxa-maps-tree:
|
|
rule: "PathPrefix(`/doxa-maps/`)"
|
|
priority: 60 # below the embed-pages router, above the site catch-all
|
|
middlewares: [doxa-maps-cors]
|
|
service: your-static-service
|