Currently, I'm deploying with the following security config. Working fine so far, I'd like to get some community feedback.
add_header Content-Security-Policy "default-src 'none'; \ connect-src 'self' https://forum.myforum.com/ wss://forum.myforum.com/ https://bootswatch.com/ https://api.github.com/; \ script-src 'self' 'unsafe-inline https://forum.myforum.com/ https://storage.googleapis.com/; \ img-src 'self' data: https://forum.myforum.com/ https://bootswatch.com/ https://i.imgur.com/ https://www.gravatar.com/; \ style-src 'self' 'unsafe-inline' https://forum.myforum.com/ https://fonts.googleapis.com/ https://maxcdn.bootstrapcdn.com/; \ font-src https://forum.myforum.com/ https://maxcdn.bootstrapcdn.com/bootswatch/latest/fonts/ chrome-extension://* https://fonts.gstatic.com/; \ frame-ancestors 'self'; \ object-src 'none'; manifest-src https://forum.myforum.com/;"; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";׬ add_header 'Referrer-Policy' 'same-origin';¬ add_header X-Content-Type-Options nosniff;¬ add_header X-XSS-Protection "1; mode=block";¬ add_header X-Download-Options noopen;¬ add_header X-Permitted-Cross-Domain-Policies none;¬ add_header X-Frame-Options "SAMEORIGIN";Helpful website for testing was https://observatory.mozilla.org/
edit: add manifest-src to enable webmanifest loading
