From 514061936bd7ace8b5da29f0b54f4535fc3fbb1d Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Fri, 10 Apr 2026 15:08:59 -0400
Subject: [PATCH] strip upstream X-Frame-Options from service proxies

---
 README.md                                       | 4 ++--
 docker/nginx/conf.d/beszel.hantim.net.conf      | 1 +
 docker/nginx/conf.d/garage.hantim.net.conf      | 1 +
 docker/nginx/conf.d/goatcounter.hantim.net.conf | 1 +
 docker/nginx/conf.d/s3.hantim.net.conf          | 1 +
 tools/service.sh                                | 1 +
 6 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 304facd..b224af3 100644
--- a/README.md
+++ b/README.md
@@ -167,8 +167,8 @@ reconnects automatically.
 Tests live in `tests/` and run with pytest:
 
 ```bash
-pip install pytest
-pytest tests/ -v
+# Install uv: curl -LsSf https://astral.sh/uv/install.sh | sh
+uvx pytest tests/ -v
 ```
 
 Tests auto-discover sites from `docker/nginx/conf.d/*.conf` — no list to
diff --git a/docker/nginx/conf.d/beszel.hantim.net.conf b/docker/nginx/conf.d/beszel.hantim.net.conf
index e537720..659c734 100644
--- a/docker/nginx/conf.d/beszel.hantim.net.conf
+++ b/docker/nginx/conf.d/beszel.hantim.net.conf
@@ -28,5 +28,6 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_hide_header X-Frame-Options;
     }
 }
diff --git a/docker/nginx/conf.d/garage.hantim.net.conf b/docker/nginx/conf.d/garage.hantim.net.conf
index f1d1971..e61a383 100644
--- a/docker/nginx/conf.d/garage.hantim.net.conf
+++ b/docker/nginx/conf.d/garage.hantim.net.conf
@@ -31,5 +31,6 @@ server {
         deny all;
 
         proxy_pass http://garage:3903;
+        proxy_hide_header X-Frame-Options;
     }
 }
diff --git a/docker/nginx/conf.d/goatcounter.hantim.net.conf b/docker/nginx/conf.d/goatcounter.hantim.net.conf
index 06b3bda..8ec4754 100644
--- a/docker/nginx/conf.d/goatcounter.hantim.net.conf
+++ b/docker/nginx/conf.d/goatcounter.hantim.net.conf
@@ -28,5 +28,6 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_hide_header X-Frame-Options;
     }
 }
diff --git a/docker/nginx/conf.d/s3.hantim.net.conf b/docker/nginx/conf.d/s3.hantim.net.conf
index 2d8cd25..702f27a 100644
--- a/docker/nginx/conf.d/s3.hantim.net.conf
+++ b/docker/nginx/conf.d/s3.hantim.net.conf
@@ -31,5 +31,6 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_hide_header X-Frame-Options;
     }
 }
diff --git a/tools/service.sh b/tools/service.sh
index 703d7a5..59b8c78 100755
--- a/tools/service.sh
+++ b/tools/service.sh
@@ -298,6 +298,7 @@ server {
         proxy_set_header Host \$host;
         proxy_set_header X-Real-IP \$remote_addr;
         proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_hide_header X-Frame-Options;
     }
 }
 NGINX