Still not working. Although FF and Chrome setups work, I see CSP related error messages there, too - only that they do not seem as restrictive as Safari is... So my best guess currently is that in general the CSP configuration of Traefik is broken in my multitenancy setup. This is the relevant part of the jitsi/web instance in my adjusted docker-compose.jitsi.yml.j2:
...
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik_public"
- "traefik.http.routers.jitsi{{ jitsi_multitenant_postfix }}.rule=Host(`{{ jitsi_virtual_host }}`)"
- "traefik.http.routers.jitsi{{ jitsi_multitenant_postfix }}.entrypoints=websecure"
- "traefik.http.routers.jitsi{{ jitsi_multitenant_postfix }}.tls=true"
- "traefik.http.routers.jitsi{{ jitsi_multitenant_postfix }}.tls.certresolver=defaultresolver"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.SSLRedirect=true"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.browserXSSFilter=true"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.contentTypeNosniff=true"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.forceSTSHeader=true"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.STSSeconds=315360000"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.STSIncludeSubdomains=true"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.STSPreload=true"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.featurePolicy=geolocation 'none'; payment 'none'"
- "traefik.http.middlewares.jitsi{{ jitsi_multitenant_postfix }}-headers.headers.contentSecurityPolicy=default-src 'self'; img-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content"
- "traefik.http.routers.jitsi{{ jitsi_multitenant_postfix }}.middlewares=jitsi{{ jitsi_multitenant_postfix }}-headers"
...
I just saw that there's a new stable out so I pruned my images and updated the instances to stable-5142-4. Will test with Safari again as soon as I get a grip on a fruity device.
I'm sorry, got that mixed up with one of my branches where I also needed to introduce such a variable :D
As long as this does not break our current setup, I'm fine with having the new labels here.
To my knowledge, this variable already exists: jitsi_bridge_udp_port
. Or do I mix up things here?
Memo for myself: This creates conflicts with the upcoming PR on multitenancy.