From 94a32709918feed4ed34538e8eaa9e27ead091a5 Mon Sep 17 00:00:00 2001
From: Philipp Rothmann <philipprothmann@posteo.de>
Date: Wed, 18 Jan 2023 22:03:12 +0100
Subject: [PATCH] feat: add frame ancestors variable

---
 .env.sample      | 1 +
 abra.sh          | 2 +-
 compose.yml      | 1 +
 coolwsd.xml.tmpl | 2 +-
 4 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.env.sample b/.env.sample
index d33f855..28ae38e 100644
--- a/.env.sample
+++ b/.env.sample
@@ -4,3 +4,4 @@ LETS_ENCRYPT_ENV=production
 NEXTCLOUD_DOMAIN=nextcloud.example.com
 ADMIN_USERNAME=admin
 SECRET_ADMIN_PASSWORD_VERSION=v1
+FRAME_ANCESTORS=
diff --git a/abra.sh b/abra.sh
index b44d613..895aa1e 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,2 +1,2 @@
 export NGINX_CONF_VERSION=v2
-export COOLWSD_XML_VERSION=v1
+export COOLWSD_XML_VERSION=v2
diff --git a/compose.yml b/compose.yml
index 03306f1..114955f 100644
--- a/compose.yml
+++ b/compose.yml
@@ -39,6 +39,7 @@ services:
       - DOMAIN=${DOMAIN}
       - DONT_GEN_SSL_CERT=true
       - NEXTCLOUD_DOMAIN=${NEXTCLOUD_DOMAIN}
+      - FRAME_ANCESTORS
     networks:
       - internal
     deploy:
diff --git a/coolwsd.xml.tmpl b/coolwsd.xml.tmpl
index 2e2e3e4..3f5fad0 100644
--- a/coolwsd.xml.tmpl
+++ b/coolwsd.xml.tmpl
@@ -125,7 +125,7 @@
         <host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
         <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
       </post_allow>
-      <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors>
+      <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space.">{{ env "FRAME_ANCESTORS" }}</frame_ancestors>
       <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by coolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs>
 
       <!-- this setting radically changes how online works, it should not be used in a production environment -->