dvorakmortonxd/dvorakmortonxd.dev
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

embed Navidrome and GitDXD service windows (pending edge X-Frame-Options removal)

Browse source
This commit is contained in:
Martin Dvořák 2026-09-24 08:02:49 +00:00
commit 8fa1f50e8a
3 changed files with 14 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

14
opencode.md
View file

@ -211,12 +211,14 @@ list reordering, not free placement. Don't confuse the two.
`eslint-disable-next-line` with a comment. Don't add more without a reason.
- Watch for `pointercancel`: any custom pointer gesture over an `<img>`, link,
or text selection needs `draggable=false` / `user-select: none`.
- Service shortcuts can show the real site in an iframe via
`createWebsiteApp({ embed: true })` (set on the shortcut's `embed` flag), but
**only for sites that don't send `X-Frame-Options` / a `frame-ancestors` CSP**.
As of writing only **Llama.cpp** and **Jellyfin** qualify; Navidrome
(`DENY`), GitDXD (`SAMEORIGIN`) and SMP/Discord (`DENY`) block framing and
keep the link card. Verify headers before enabling `embed` on a new service.
- Service shortcuts show the real site in an iframe via
`createWebsiteApp({ embed: true })` (the shortcut's `embed` flag). It only
works for sites that don't send `X-Frame-Options` / a `frame-ancestors` CSP.
`embed` is set on Llama.cpp (Open WebUI), Jellyfin, Navidrome and GitDXD; SMP
(Discord) is excluded because Discord sends `DENY`. Navidrome (`DENY`) and
GitDXD (`SAMEORIGIN`) still need those headers stripped at the edge (a
Cloudflare "Modify Response Header" rule or nginx) before their frames render.
Always verify headers before enabling `embed` on a new service.
- Reduced motion is handled with a near-zero `animation-duration` (not
`animation: none`) so `animationend` still fires and windows unmount.