From 1f96169d8cf217701a87f2e111f35ab7e43df074 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Tue, 4 Aug 2026 11:55:09 +0200
Subject: [PATCH] =?UTF-8?q?nextcloud:=20CORS=20(cette=20fois=20c=E2=80=99e?=
 =?UTF-8?q?st=20la=20bonne)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 hosts/vm/nextcloud/nextcloud.nix | 31 +++++++------------------------
 1 file changed, 7 insertions(+), 24 deletions(-)

diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix
index 11dba6e..b4d125d 100644
--- a/hosts/vm/nextcloud/nextcloud.nix
+++ b/hosts/vm/nextcloud/nextcloud.nix
@@ -54,28 +54,11 @@
   };
 
   # Activation CORS pour récuppérer les agendas depuis le wiki
-  # On est obligé de répéter les headers communs de sécurité car ils ne sont pas au même niveau
-  # https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
-  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig =
-    let
-      base_headers = ''
-        add_header X-Content-Type-Options nosniff;
-        add_header X-Robots-Tag noindex, nofollow;
-        add_header X-Permitted-Cross-Domain-Policies none;
-        add_header X-Frame-Options sameorigin;
-        add_header Referrer-Policy no-referrer;
-        add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
-        add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
-      '';
-    in
-    ''
-      ${base_headers}
-      if ($request_method = 'OPTIONS') {
-        ${base_headers}
-        add_header 'Access-Control-Max-Age' 86400;
-        add_header 'Content-Type' 'text/plain; charset=utf-8';
-        add_header 'Content-Length' 0;
-        return 204;
-      }
-    '';
+  # TODO: à mettre que sur /remote.php/dav/public-calendars/ pour éviter des requêtes malveillantes depuis le wiki.
+  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.extraConfig = ''
+    add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
+    add_header 'Access-Control-Allow-Methods' 'GET' always;
+    add_header 'Access-Control-Allow-Credentials' 'false' always;
+    add_header 'Vary' 'Origin' always;
+  '';
 }