element-web: Add security headers to nginx config

Replaces !26

charts/element-web/Chart.yaml

@@ -10,7 +10,7 @@ icon: https://element.io/images/element-logo.svg
 appVersion: 1.9.9
 
 type: application
-version: 1.0.44
+version: 1.1.0
 
 maintainers:
   - name: Alexander Olofsson

charts/element-web/templates/configuration-nginx.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-nginx" (include "element-web.fullname" .) | trunc 63 | trimSuffix "-" }}
+  labels:
+    {{- include "element-web.labels" . | nindent 4 }}
+data:
+  default.conf: |
+    server {
+        listen       80;
+        listen  [::]:80;
+        server_name  localhost;
+
+        root   /usr/share/nginx/html;
+        index  index.html;
+
+{{ .Values.nginxConfig | indent 8 }}
+
+        # Set no-cache for the index.html only so that browsers always check for a new copy of Element Web.
+        location = /index.html {
+            add_header Cache-Control "no-cache";
+        }
+
+        # redirect server error pages to the static page /50x.html
+        #
+        error_page   500 502 503 504  /50x.html;
+    }

charts/element-web/templates/deployment.yaml

@@ -16,6 +16,7 @@ spec:
     metadata:
       annotations:
         checksum/config: {{ include (print .Template.BasePath "/configuration.yaml") . | sha256sum }}
+        checksum/config-nginx: {{ include (print .Template.BasePath "/configuration-nginx.yaml") . | sha256sum }}
     {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
     {{- end }}
@@ -53,6 +54,8 @@ spec:
             - mountPath: /app/config.json
               name: config
               subPath: config.json
+            - mountPath: /etc/nginx/conf.d
+              name: config-nginx
           {{- with .Values.extraVolumeMounts }}
           {{- . | toYaml | nindent 12 }}
           {{- end }}
@@ -60,6 +63,9 @@ spec:
         - name: config
           configMap:
             name: {{ include "element-web.fullname" . }}
+        - name: config-nginx
+          configMap:
+            name: {{ printf "%s-nginx" (include "element-web.fullname" .) | trunc 63 | trimSuffix "-" }}
       {{- with .Values.extraVolumes }}
       {{- . | toYaml | nindent 8 }}
       {{- end }}

charts/element-web/values.yaml

@@ -28,6 +28,14 @@ defaultServer:
 ##
 config: {}
 
+## Configuration to add into the nginx server object
+##
+nginxConfig: |-
+  add_header X-Frame-Options SAMEORIGIN;
+  add_header X-Content-Type-Options nosniff;
+  add_header X-XSS-Protection "1; mode=block";
+  add_header Content-Security-Policy "frame-ancestors 'none'";
+
 ## Configuration for mounting additional volumes into the application container.
 ##
 extraVolumes: {}