Android Memories app "failed to fetch" photos on home screen

[rosbeef]

Only on home screen of Android Memories app the error "failed to fetch" photos apears.

Sure something related to pulsejet/memories#1396 so pulsejet/memories#1336 in which resolve the problem adding to nginx :
add_header Content-Security-Policy "connect-src 'self'; default-src 'none'; font-src 'self' data:; frame-src 'self' https://onlyoffice.exu.li; img-src 'self' data: https://* blob:; media-src 'self'; script-src-elem 'self' 'unsafe-inline' https://onlyoffice.exu.li; style-src-elem 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; worker-src 'self'; frame-ancestors 'self';";

How and where to apply automaticaly that on nextcloud_ynh ?

[rosbeef]

Hi please help to convert caddy config file to yunohost nginx config file

caddy file :

# Handle ALL Memories-related paths without CSP
handle /apps/memories/* {
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        
        # Remove headers that interfere with mobile app
        -Content-Security-Policy
        -Feature-Policyé
        -X-Frame-Options
        -X-Content-Type-Options
        -X-XSS-Protection
        -Referrer-Policy
        -X-Permitted-Cross-Domain-Policies
        -Server
    }
    reverse_proxy localhost:8000 {
        header_up Host {host}
        header_up X-Real-IP {remote}
    }
}

I think this is not needed because custom_apps folder does not exist in nextcloud folder

# Handle custom_apps/memories paths (for JS/CSS assets)
handle /custom_apps/memories/* {
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        
        # Remove CSP for Memories assets
        -Content-Security-Policy
        -Feature-Policy
        -X-Frame-Options
        -X-Content-Type-Options
        -X-XSS-Protection
        -Referrer-Policy
        -X-Permitted-Cross-Domain-Policies
        -Server
    }
    reverse_proxy localhost:8000 {
        header_up Host {host}
        header_up X-Real-IP {remote}
    }
}

I think this is not needed because v2.php is a file in nextcloud folder, not a folder

# Handle OCS API calls that Memories uses
handle /ocs/v2.php/apps/memories/* {
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        
        # Remove CSP for OCS API
        -Content-Security-Policy
        -Feature-Policy
        -X-Frame-Options
        -X-Content-Type-Options
        -X-XSS-Protection
        -Referrer-Policy
        -X-Permitted-Cross-Domain-Policies
        -Server
    }
    reverse_proxy localhost:8000 {
        header_up Host {host}
        header_up X-Real-IP {remote}
    }
}

I think this is not needed because already included in nextcloud.conf nginx file

# Everything else gets full security headers including CSP
handle {
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Frame-Options "SAMEORIGIN"
        X-Content-Type-Options "nosniff"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; frame-src 'self'; worker-src 'self' blob:; child-src 'self' blob:; frame-ancestors 'self'; form-action 'self'"
        -Server
    }
    reverse_proxy localhost:8000 {
        header_up Host {host}
        header_up X-Real-IP {remote}
    }
}

[rosbeef]

So

# Handle ALL Memories-related paths without CSP
handle /apps/memories/* {
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        
        # Remove headers that interfere with mobile app
        -Content-Security-Policy
        -Feature-Policyé
        -X-Frame-Options
        -X-Content-Type-Options
        -X-XSS-Protection
        -Referrer-Policy
        -X-Permitted-Cross-Domain-Policies
        -Server
    }
    reverse_proxy localhost:8000 {
        header_up Host {host}
        header_up X-Real-IP {remote}
    }
}

Should be something like that in a file in /etc/nginx/host.domain.tld/nextcloud.d/memories.conf ? I tried it but does not effect.

location ~ ^/apps/memories {
    alias /var/www/nextcloud/apps/memories/;
    more_set_headers "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload";

    more_clear_headers "Content-Security-Policy";
    more_clear_headers "Feature-Policy";
    more_clear_headers "X-Frame-Options";
    more_clear_headers "X-Content-Type-Options";
    more_clear_headers "X-XSS-Protection";
    more_clear_headers "Referrer-Policy";
    more_clear_headers "X-Permitted-Cross-Domain-Policies";
    more_clear_headers "Server";

## do theses lines are required ?        
#    proxy_http_version 1.1;
#    proxy_set_header Upgrade $http_upgrade;
#    proxy_set_header Connection $connection_upgrade;

#    proxy_set_header Host $host;
#    proxy_set_header X-Forwarded-Server $host;
#    proxy_set_header X-Real-IP $remote_addr;   
}