BREAKING: update CSP configuration

Disable it by default and add ability to specify a custom report uri

2 files changed, 11 insertions, 2 deletions

diff --git a/config/default.yaml b/config/default.yaml
index 1f6046a1b..6c339e66d 100644
--- a/config/default.yaml
+++ b/config/default.yaml
@@ -96,6 +96,11 @@ redundancy:
 #        strategy: 'recently-added' # Cache recently added videos
 #        min_views: 10 # Having at least x views
 
+csp:
+  enabled: false
+  report_only: true # CSP directives are still being tested, so disable the report only mode at your own risk!
+  report_uri:
+
 cache:
   previews:
     size: 500 # Max number of previews you want to cache
@@ -182,8 +187,6 @@ instance:
     "# If you would like to report a security issue\n# you may report it to:\nContact: https://github.com/Chocobozzz/PeerTube/blob/develop/SECURITY.md\nContact: mailto:"
 
 services:
-  # You can provide a reporting endpoint for Content Security Policy violations
-  csp-logger:
   # Cards configuration to format video in Twitter
   twitter:
     username: '@Chocobozzz' # Indicates the Twitter account for the website or platform on which the content was published
diff --git a/config/production.yaml.example b/config/production.yaml.example
index ae8fb2d51..c227d5fcc 100644
--- a/config/production.yaml.example
+++ b/config/production.yaml.example
@@ -97,6 +97,12 @@ redundancy:
 #        strategy: 'recently-added' # Cache recently added videos
 #        min_views: 10 # Having at least x views
 
+csp:
+  enabled: false
+  report_only: true # CSP directives are still being tested, so disable the report only mode at your own risk!
+  report_uri:
+
+
 ###############################################################################
 #
 # From this point, all the following keys can be overridden by the web interface