csp.yml

---
flags:
  script-src-elem:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: with the web UI on, the dashboard document sets its auth flags and the sign-in page submits its form through inline scripts without a nonce, so neither the dashboard nor the password sign-in starts without it
whitelist:
  font-src: []
  connect-src: []