# Upstream's CSP with only frame-ancestors 'none' relaxed to 'self' (see below).
# An empty value, when upstream sends no CSP, makes add_header send nothing.
map $upstream_http_content_security_policy $omniroute_csp {
    default $upstream_http_content_security_policy;
    "~*^(?<csp_pre>.*)frame-ancestors\s+'none'(?<csp_post>.*)$" "${csp_pre}frame-ancestors 'self'${csp_post}";
}

server {
    listen %%interface%%:%%port%% default_server;
    listen 20128 default_server;

    client_max_body_size 0;

    proxy_http_version 1.1;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    proxy_buffering off;
    proxy_read_timeout 30m;
    proxy_send_timeout 30m;

    # Upstream sends X-Frame-Options: DENY and frame-ancestors 'none' on every route
    # (its DASHBOARD_ALLOW_EMBED switch is build-time only), which blocks the Home
    # Assistant ingress iframe. Allow same-origin framing, keep the rest of its CSP.
    proxy_hide_header X-Frame-Options;
    proxy_hide_header Content-Security-Policy;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Content-Security-Policy $omniroute_csp always;

    location = / {
        proxy_pass http://127.0.0.1:20129%%ingress_entry%%;
    }

    location %%ingress_entry%% {
        proxy_pass http://127.0.0.1:20129;
    }

    location / {
        proxy_pass http://127.0.0.1:20129%%ingress_entry%%/;
    }
}