csp.yml

---
whitelist:
  frame-ancestors:
    - "*.{{ DOMAIN_PRIMARY }}"
flags:
  style-src-attr:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface