Hello @AlexQ Thanks for your answer. It's been a while since I worked with that installation, but as far as I remember I've got that issue with the Docker installation after upgrading from Version 5.7 to version 6.0. Back then I started afterwards from scratch with the native installation since I've heard that SSO is not available for Cryptpad docker install .
a) yes, it's a new install but upgraded from 6.0 to 9.0
b) yes, 2024.9.0
c) Debian 12
e) nginx config is the standard example config suggested in the installation guide (on github)
f) actually I thought that the actuall server name is to be replaced for server_name
. But apparently I was wrong. So that the first thing that's not right and I've correct it, but after restarting nginx and cryptpad, there is not change in regard to the blocked page.
g) since my Cryptpad server is in a trusted environment behind a reverse proxy, I removed all of the SSL config (as I also do with other apps). Am I required to change to SSL config (or is it recommended anyways?) The SSL certificate resides on the reverse proxy, but I could also copy the certificate on the cryptpad server, but I would prefer to let the reverse proxy renew the certificate.
Actually I don't really need nginx. I only configured it out of desperation because it didn't work even without nginx. I thought I have more options with nginx in regards to the reverse proxy config.
1) nginx -t is OK, test successful
2) The checkup had the following 5 issue's and they all seem to be related to a reverse proxy issue.
Your browser was not able to load an iframe using the origin specified as httpSafeOrigin (https://cryptpad-sand.domain) in cryptpad/config/config.js. This can be caused by an invalid httpUnsafeDomain, invalid CSP configuration in your reverse proxy, invalid SSL certificates, and many other factors. More information about your particular error may be found in your browser console. Changes to cryptpad/config/config.js will require a server restart in order for /api/config to be updated.
/sheet/inner.html does not have the required 'content-security-policy' headers set. This is most often related to incorrectly configured sandbox domains or reverse proxies.
/common/onlyoffice/dist/v7/web-apps/apps/spreadsheeteditor/main/index.html does not have the required 'content-security-policy' headers set. This is most often related to incorrectly configured sandbox domains or reverse proxies.
api/config returned an HTTP status code other than 200 when accessed from the sandbox domain.
https://cryptpad.domain.org/sheet/inner.html was served with incorrect Content-Security-Policy headers.
A value of "'none'" was expected for the default-src directive.
A value of "'unsafe-inline' 'self' https://cryptpad.domain" was expected for the style-src directive.
A value of "'self' data: https://cryptpad.domain" was expected for the font-src directive.
A value of "https://cryptpad.domain" was expected for the child-src directive.
A value of "'self' blob: https://cryptpad-sand.domain" was expected for the frame-src directive.
A value of "'self' resource: https://cryptpad.domain 'unsafe-eval' 'unsafe-inline'" was expected for the script-src directive.
A value of "'self' blob: https://cryptpad.domain https://cryptpad-sand.domain wss://cryptpad.domain" was expected for the connect-src directive. This rule restricts which URLs can be loaded by scripts. Overly permissive settings can allow users to be tracked using external resources, while overly restrictive settings may block pages from loading entirely.
A value of "'self' data: blob: https://cryptpad.domain" was expected for the img-src directive.
A value of "blob:" was expected for the media-src directive.
A value of "'self' https://cryptpad.domain" was expected for the frame-ancestors directive. This rule determines which sites can embed content from this instance in an iframe.
A value of "'self'" was expected for the worker-src directive.