app-platform: remove revoked onlyoffice app

README.md

@@ -21,7 +21,7 @@
 - **Fedimint** federation guardian and gateway
 
 ### Self-Hosted Apps (30)
-Bitcoin (ThunderHub), Storage (FileBrowser, Immich, Nextcloud), Productivity (Penpot, OnlyOffice, Vaultwarden), Media (Jellyfin, PhotoPrism), Search (SearXNG), AI (Ollama), Network (Tailscale, Nginx Proxy Manager), Home (Home Assistant), Nostr (nostr-rs-relay, Nostrudel), Dev (Grafana, Portainer), and more.
+Bitcoin (ThunderHub), Storage (FileBrowser, Immich, Nextcloud), Productivity (Penpot, Vaultwarden), Media (Jellyfin, PhotoPrism), Search (SearXNG), AI (Ollama), Network (Tailscale, Nginx Proxy Manager), Home (Home Assistant), Nostr (nostr-rs-relay, Nostrudel), Dev (Grafana, Portainer), and more.
 
 ### Decentralized Identity
 - Ed25519 node identity with DID Documents (did:key)

apps/DEVELOPMENT.md

@@ -33,7 +33,6 @@
 | ollama | 11434 | v0.5.4 |
 | grafana | 3001 | v10.2.0 |
 | portainer | 9000 | v2.19.4 |
-| onlyoffice | 8088 | v7.5.1 |
 | penpot | 8089 | v2.4 |
 
 ## Building Apps

apps/PORTS.md

@@ -17,7 +17,6 @@ This document lists all port assignments for Archipelago apps.
 | mempool | 4080 | TCP | Web UI | 14080 |
 | ollama | 11434 | TCP | API | 21434 |
 | searxng | 8888 | TCP | Web UI | 18888 |
-| onlyoffice | 8088 | TCP | Web UI | 18088 |
 | penpot | 8089 | TCP | Web UI | 18089 |
 | lnd | 9735, 10009, 18080 | TCP | P2P, gRPC, REST | 19735, 20009, 28080 |
 | core-lightning | 9736, 9835 | TCP | P2P, gRPC | 19736, 19835 |
@@ -47,7 +46,6 @@ In development mode, all ports are offset by 10000 to avoid conflicts with produ
 | Mempool | http://localhost:14080 |
 | Ollama | http://localhost:21434 |
 | SearXNG | http://localhost:18888 |
-| OnlyOffice | http://localhost:18088 |
 | Penpot | http://localhost:18089 |
 | LND REST | http://localhost:18080 |
 | Core Lightning | http://localhost:19835 |

apps/README.md

@@ -23,7 +23,7 @@ Containerized applications for the Archipelago Bitcoin Node OS. All apps run in
 
 ### Self-Hosted Services
 - **nextcloud** (v28), **jellyfin** (v10.8.13), **immich** (release), **photoprism** (v240915)
-- **vaultwarden** (v1.30.0-alpine), **onlyoffice** (v7.5.1), **penpot** (v2.4)
+- **vaultwarden** (v1.30.0-alpine), **penpot** (v2.4)
 - **homeassistant** (v2024.1), **filebrowser** (v2.27.0), **searxng** (2024.11.17)
 - **ollama** (v0.5.4), **grafana** (v10.2.0), **portainer** (v2.19.4)
 

apps/onlyoffice/Dockerfile

@@ -1,5 +0,0 @@
-# OnlyOffice - uses official image
-FROM onlyoffice/documentserver:7.5.0
-
-# Default configuration is in the image
-# No additional setup needed

apps/onlyoffice/manifest.yml

@@ -1,54 +0,0 @@
-app:
-  id: onlyoffice
-  name: OnlyOffice
-  version: 7.5.0
-  description: Office suite and document collaboration. Edit documents, spreadsheets, and presentations.
-  
-  container:
-    image: onlyoffice/documentserver:7.5.0
-    image_signature: cosign://...
-    pull_policy: if-not-present
-    
-  dependencies:
-    - storage: 10Gi
-    
-  resources:
-    cpu_limit: 4
-    memory_limit: 4Gi
-    disk_limit: 10Gi
-    
-  security:
-    capabilities: []
-    readonly_root: false  # OnlyOffice needs write access
-    no_new_privileges: true
-    user: 1000
-    seccomp_profile: default
-    network_policy: isolated
-    apparmor_profile: onlyoffice
-    
-  ports:
-    - host: 8088
-      container: 80
-      protocol: tcp  # Web UI
-    
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/onlyoffice
-      target: /var/www/onlyoffice/Data
-      options: [rw]
-      
-  environment:
-    - JWT_ENABLED=false
-    - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
-    
-  health_check:
-    type: http
-    endpoint: http://localhost:8088
-    path: /healthcheck
-    interval: 30s
-    timeout: 5s
-    retries: 3
-
-  metadata:
-    launch:
-      open_in_new_tab: true

image-recipe/configs/nginx-archipelago.conf

@@ -490,21 +490,6 @@ server {
         sub_filter_once on;
         sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
     }
-    location /app/onlyoffice/ {
-        proxy_pass http://127.0.0.1:8044/;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_hide_header X-Frame-Options;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        proxy_hide_header Content-Security-Policy;
-        add_header X-Content-Type-Options "nosniff" always;
-        proxy_set_header Accept-Encoding "";
-        sub_filter_once on;
-        sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
-    }
     # Remaining apps (also available on HTTPS via snippet include)
     location /app/searxng/ {
         proxy_pass http://127.0.0.1:8888/;

image-recipe/configs/snippets/archipelago-https-app-proxies.conf

@@ -117,20 +117,6 @@ location /app/lnd/ {
     sub_filter_once on;
     sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
 }
-location /app/onlyoffice/ {
-    proxy_pass http://127.0.0.1:8044/;
-    proxy_http_version 1.1;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_hide_header X-Frame-Options;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    proxy_hide_header Content-Security-Policy;
-    proxy_set_header Accept-Encoding "";
-    sub_filter_once on;
-    sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
-}
 location /app/jellyfin/ {
     proxy_pass http://127.0.0.1:8096/;
     proxy_http_version 1.1;

neode-ui/mock-backend.js

@@ -253,7 +253,6 @@ const portMappings = {
   'nostr-rs-relay': 7000,
   'syncthing': 8384,
   'penpot': 9001,
-  'onlyoffice': 8044,
   'nginx-proxy-manager': 8181,
   'indeedhub': 8190,
   'dwn': 3000,
@@ -283,7 +282,6 @@ async function getDockerContainers() {
       'mempool-electrs': 'mempool-electrs',
       'archy-ollama': 'ollama',
       'archy-searxng': 'searxng',
-      'archy-onlyoffice': 'onlyoffice',
       'archy-penpot-frontend': 'penpot'
     }
 
@@ -361,11 +359,6 @@ async function getDockerContainers() {
           icon: '/assets/img/app-icons/searxng.png',
           description: 'Privacy-respecting metasearch engine'
         },
-        'onlyoffice': {
-          title: 'OnlyOffice',
-          icon: '/assets/img/onlyoffice.webp',
-          description: 'Office suite and document collaboration'
-        },
         'penpot': {
           title: 'Penpot',
           icon: '/assets/img/penpot.webp',
@@ -463,7 +456,6 @@ const marketplaceMetadata = {
   'grafana': { title: 'Grafana', shortDesc: 'Analytics and monitoring dashboards', icon: '/assets/img/app-icons/grafana.png' },
   'searxng': { title: 'SearXNG', shortDesc: 'Privacy-respecting metasearch engine', icon: '/assets/img/app-icons/searxng.png' },
   'ollama': { title: 'Ollama', shortDesc: 'Run large language models locally', icon: '/assets/img/app-icons/ollama.png' },
-  'onlyoffice': { title: 'OnlyOffice', shortDesc: 'Office suite for document collaboration', icon: '/assets/img/app-icons/onlyoffice.webp' },
   'penpot': { title: 'Penpot', shortDesc: 'Open-source design and prototyping platform', icon: '/assets/img/app-icons/penpot.webp' },
   'nextcloud': { title: 'Nextcloud', shortDesc: 'Self-hosted cloud storage and collaboration', icon: '/assets/img/app-icons/nextcloud.webp' },
   'vaultwarden': { title: 'Vaultwarden', shortDesc: 'Self-hosted password manager (Bitwarden-compatible)', icon: '/assets/img/app-icons/vaultwarden.webp' },

neode-ui/scripts/download-app-icons.js

@@ -25,7 +25,6 @@ const appIds = [
   'mempool',
   'ollama',
   'searxng',
-  'onlyoffice',
   'penpot'
 ]
 
@@ -38,7 +37,6 @@ const repoMap = {
   'lightning-stack': 'lnd-startos',
   'mempool': 'mempool-startos',
   'searxng': 'searxng-startos',
-  'onlyoffice': 'onlyoffice-startos',
   'penpot': 'penpot-startos',
 }
 
@@ -170,4 +168,3 @@ async function main() {
 }
 
 main().catch(console.error)
-

neode-ui/src/stores/appLauncher.ts

@@ -25,7 +25,6 @@ const NEW_TAB_APP_IDS = new Set([
   'vaultwarden',
   'nextcloud',
   'portainer',
-  'onlyoffice',
   'tailscale',
   'nginx-proxy-manager',
   'uptime-kuma',
@@ -105,7 +104,6 @@ const PORT_TO_APP_ID: Record<string, string> = {
   '9000': 'portainer',
   '8087': 'netbird',
   '8086': 'netbird',
-  '9980': 'onlyoffice',
   '11434': 'ollama',
   '2283': 'immich',
   '23000': 'btcpay-server',
@@ -127,7 +125,6 @@ const APP_ID_TO_PORT: Record<string, string> = {
   vaultwarden: '8082',
   nextcloud: '8085',
   portainer: '9000',
-  onlyoffice: '8044',
   tailscale: '8240',
   'nginx-proxy-manager': '8081',
   'uptime-kuma': '3002',

neode-ui/src/utils/dummyApps.ts

@@ -438,42 +438,6 @@ export const dummyApps: Record<string, PackageDataEntry> = {
       status: ServiceStatus.Running
     }
   },
-  'onlyoffice': {
-    state: PackageState.Running,
-    'static-files': {
-      license: 'AGPL-3.0',
-      instructions: 'Office suite and document collaboration',
-      icon: '/assets/img/onlyoffice.webp'
-    },
-    manifest: {
-      id: 'onlyoffice',
-      title: 'OnlyOffice',
-      version: '7.5.0',
-      description: {
-        short: 'Office suite and document collaboration',
-        long: 'OnlyOffice is a secure office suite that enables real-time collaborative editing of documents, spreadsheets, and presentations. Self-hosted alternative to Google Workspace and Microsoft 365.'
-      },
-      'release-notes': 'Initial release',
-      license: 'AGPL-3.0',
-      'wrapper-repo': 'https://github.com/ONLYOFFICE/DocumentServer',
-      'upstream-repo': 'https://github.com/ONLYOFFICE/DocumentServer',
-      'support-site': 'https://github.com/ONLYOFFICE/DocumentServer/issues',
-      'marketing-site': 'https://www.onlyoffice.com',
-      'donation-url': null
-    },
-    installed: {
-      'current-dependents': {},
-      'current-dependencies': {},
-      'last-backup': null,
-      'interface-addresses': {
-        main: {
-          'tor-address': 'onlyoffice.onion',
-          'lan-address': 'http://localhost:8083'
-        }
-      },
-      status: ServiceStatus.Running
-    }
-  },
   'indeedhub': {
     state: PackageState.Running,
     'static-files': {

neode-ui/src/views/Apps.vue

@@ -3,13 +3,15 @@
     <!-- Nav header -- tabs + categories + search -->
     <div class="mb-4">
       <!-- Desktop: page tabs + category tabs + search -->
-      <div class="hidden md:flex items-center gap-4">
+      <div ref="appsHeaderRef" class="hidden md:flex items-center gap-4 relative">
-        <div class="mode-switcher hidden md:inline-flex flex-shrink-0">
+        <div ref="appsPrimaryRef" class="flex-shrink-0">
+          <div class="mode-switcher hidden md:inline-flex">
             <button class="mode-switcher-btn" :class="{ 'mode-switcher-btn-active': activeTab === 'apps' }" @click="activeTab = 'apps'; router.replace({ query: {} })">My Apps</button>
             <RouterLink to="/dashboard/discover" class="mode-switcher-btn">App Store</RouterLink>
             <button class="mode-switcher-btn" :class="{ 'mode-switcher-btn-active': activeTab === 'websites' }" @click="activeTab = 'websites'; router.replace({ query: { tab: 'websites' } })">Websites</button>
           </div>
-        <div v-if="activeTab === 'apps' && categoriesWithApps.length > 1" class="mode-switcher category-tabs-wide hidden md:inline-flex flex-shrink-0">
+        </div>
+        <div v-show="activeTab === 'apps' && categoriesWithApps.length > 1 && !collapseCategories" class="mode-switcher category-tabs-wide hidden md:inline-flex flex-shrink-0">
           <button
             v-for="category in categoriesWithApps"
             :key="category.id"
@@ -18,6 +20,32 @@
             :class="{ 'mode-switcher-btn-active': selectedCategory === category.id }"
           >{{ category.name }}</button>
         </div>
+        <div v-show="activeTab === 'apps' && categoriesWithApps.length > 1 && collapseCategories" class="segmented-select flex-shrink-0">
+          <label class="sr-only" for="apps-category-select">My Apps category</label>
+          <select
+            id="apps-category-select"
+            v-model="selectedCategory"
+            class="segmented-select-control"
+          >
+            <option
+              v-for="category in categoriesWithApps"
+              :key="category.id"
+              :value="category.id"
+            >
+              {{ category.name }}
+            </option>
+          </select>
+        </div>
+        <div ref="appsCategoryProbeRef" class="mode-switcher category-tabs-probe" aria-hidden="true">
+          <button
+            v-for="category in categoriesWithApps"
+            :key="category.id"
+            class="mode-switcher-btn"
+            type="button"
+          >
+            {{ category.name }}
+          </button>
+        </div>
         <div class="app-header-search-wrap flex items-center gap-2">
           <input
             v-model="searchQuery"
@@ -318,6 +346,7 @@ import { useLastKnownPackages } from './apps/appPackageCache'
 import { useAppsActions } from './apps/useAppsActions'
 import { validateSideloadRequest } from './apps/sideloadValidation'
 import { useMarketplaceApp } from '@/composables/useMarketplaceApp'
+import { useCollapsingHeaderTabs } from '@/composables/useCollapsingHeaderTabs'
 import {
   type AppsTab, filterEntriesForTab, isWebOnlyApp, isWebsitePackage, opensInTab, resolveRuntimeLaunchUrl,
   WEB_ONLY_APPS, WEB_ONLY_APP_URLS, buildAllCategories, useCategoriesWithApps,
@@ -411,6 +440,15 @@ const packages = computed(() => {
 })
 
 const categoriesWithApps = useCategoriesWithApps(packages, ALL_CATEGORIES)
+const appsHeaderRef = ref<HTMLElement | null>(null)
+const appsPrimaryRef = ref<HTMLElement | null>(null)
+const appsCategoryProbeRef = ref<HTMLElement | null>(null)
+const { collapsed: collapseCategories } = useCollapsingHeaderTabs(
+  appsHeaderRef,
+  appsPrimaryRef,
+  appsCategoryProbeRef,
+  144
+)
 
 const curatedApps = getCuratedAppList()
 const marketplaceMatches = computed(() => {

neode-ui/src/views/Kiosk.vue

@@ -101,7 +101,6 @@ const launchableApps = computed<KioskApp[]>(() => {
     'filebrowser': '/app/filebrowser/',
     'searxng': '/app/searxng/',
     'ollama': '/app/ollama/',
-    'onlyoffice': '/app/onlyoffice/',
     'portainer': '/app/portainer/',
     'uptime-kuma': '/app/uptime-kuma/',
     'nginx-proxy-manager': '/app/nginx-proxy-manager/',

neode-ui/src/views/appDetails/appDetailsData.ts

@@ -32,7 +32,6 @@ export const ROUTE_TO_PACKAGE_KEY: Record<string, string> = {
   grafana: 'grafana',
   searxng: 'searxng',
   ollama: 'ollama',
-  onlyoffice: 'onlyoffice',
   nextcloud: 'nextcloud',
   vaultwarden: 'vaultwarden',
   jellyfin: 'jellyfin',
@@ -77,7 +76,6 @@ export const APP_URLS: Record<string, { dev: string; prod: string }> = {
   'mempool': { dev: 'http://localhost:4080', prod: 'http://localhost:4080' },
   'ollama': { dev: 'http://localhost:11434', prod: 'http://localhost:11434' },
   'searxng': { dev: 'http://localhost:8888', prod: 'http://localhost:8888' },
-  'onlyoffice': { dev: 'http://localhost:9980', prod: 'http://localhost:9980' },
   'nextcloud': { dev: 'http://localhost:8085', prod: 'http://localhost:8085' },
   'vaultwarden': { dev: 'http://localhost:8082', prod: 'http://localhost:8082' },
   'jellyfin': { dev: 'http://localhost:8096', prod: 'http://localhost:8096' },

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -16,35 +16,17 @@ export const APP_PORTS: Record<string, number> = {
   'electrs':       50002,
   'archy-electrs-ui': 50002,
   'mempool-electrs': 50002,
-  'btcpay-server': 23000,
   'lnd':           18083,
   'archy-lnd-ui':  18083,
-  'mempool':       4080,
   'mempool-web':   4080,
-  'archy-mempool-web': 4080,
-  'homeassistant': 8123,
-  'grafana':       3000,
-  'searxng':       8888,
   'ollama':        11434,
-  'onlyoffice':    8044,
-  'nextcloud':     8085,
-  'vaultwarden':   8082,
-  'jellyfin':      8096,
-  'photoprism':    2342,
   'immich':        2283,
   'immich_server': 2283,
-  'filebrowser':   8083,
   'nginx-proxy-manager': 8081,
-  'gitea':         3001,
-  'portainer':     9000,
   'netbird':       8087,
   'tailscale':     8240,
-  'uptime-kuma':   3002,
-  'fedimint':      8175,
   'fedimintd':     8175,
   'fedimint-gateway': 8176,
-  'indeedhub':     7778,
-  'botfights':     9100,
   'dwn':           3100,
   'endurain':      8080,
 }

neode-ui/src/views/appSession/generatedAppSessionConfig.ts

@@ -20,7 +20,6 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
   "morphos-server": 8086,
   "nextcloud": 8085,
   "nostr-rs-relay": 18081,
-  "onlyoffice": 8088,
   "photoprism": 2342,
   "portainer": 9000,
   "router": 8084,
@@ -63,7 +62,6 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
   "morphos-server": "MorphOS Server",
   "nextcloud": "Nextcloud",
   "nostr-rs-relay": "Nostr Relay (Rust)",
-  "onlyoffice": "OnlyOffice",
   "photoprism": "PhotoPrism",
   "portainer": "Portainer",
   "router": "Mesh Router",
@@ -80,7 +78,6 @@ export const GENERATED_NEW_TAB_APPS = new Set<string>([
   "grafana",
   "homeassistant",
   "nextcloud",
-  "onlyoffice",
   "photoprism",
   "portainer",
   "uptime-kuma",

scripts/check-app-catalog-drift.py

@@ -25,7 +25,6 @@ INTERNAL_MANIFEST_IDS = {
     "lnd-ui",
     "mempool-api",
     "morphos-server",
-    "onlyoffice",
     "router",
     "strfry",
     "web5-dwn",

scripts/container-specs.sh

@@ -465,18 +465,6 @@ load_spec_searxng() {
   SPEC_OPTIONAL="true"
 }
 
-load_spec_onlyoffice() {
-  reset_spec
-  SPEC_NAME="onlyoffice"
-  SPEC_IMAGE="${ONLYOFFICE_IMAGE}"
-  SPEC_PORTS="9980:80"
-  SPEC_MEMORY="$(mem_limit onlyoffice)"
-  SPEC_HEALTH_CMD="curl -sf http://localhost:80/ || exit 1"
-  SPEC_TIER="3"
-  SPEC_CAPS="CHOWN SETUID SETGID DAC_OVERRIDE"
-  SPEC_OPTIONAL="true"
-}
-
 load_spec_filebrowser() {
   reset_spec
   SPEC_NAME="filebrowser"
@@ -617,7 +605,6 @@ ALL_CONTAINER_SPECS=(
   vaultwarden
   nextcloud
   searxng
-  onlyoffice
   filebrowser
   nginx-proxy-manager
   portainer

scripts/deploy-tailscale.sh

@@ -340,7 +340,7 @@ deploy_node() {
         # Containers running as root (UID 0 → host UID 100000)
         for dir in lnd electrumx btcpay nbxplorer jellyfin vaultwarden \
                    home-assistant fedimint fedimint-gateway photoprism ollama filebrowser \
-                   nextcloud uptime-kuma onlyoffice nginx-proxy-manager portainer nostr-rs-relay searxng; do
+                   nextcloud uptime-kuma nginx-proxy-manager portainer nostr-rs-relay searxng; do
             [ -d "/var/lib/archipelago/$dir" ] && sudo chown -R 100000:100000 "/var/lib/archipelago/$dir" 2>/dev/null
         done
         # Bitcoin Knots: container UID 101 → host UID 100101
@@ -893,18 +893,6 @@ LNDCONF
                     -e PHOTOPRISM_ADMIN_PASSWORD=archipelago -e PHOTOPRISM_DEFAULT_LOCALE=en \
                     $PHOTOPRISM_IMAGE
             fi
-            # OnlyOffice
-            if ! \$DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qx onlyoffice; then
-                if \$DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -qx onlyoffice; then
-                    \$DOCKER start onlyoffice 2>/dev/null || true
-                else
-                    \$DOCKER run -d --name onlyoffice --restart unless-stopped \
-                        --health-cmd 'curl -sf http://localhost:80/'  --health-interval=30s --health-timeout=5s --health-retries=3 \
-                        --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
-                        --security-opt no-new-privileges:true \
-                        -p 9980:80 $ONLYOFFICE_IMAGE
-                fi
-            fi
             # Nginx Proxy Manager
             if ! \$DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qx nginx-proxy-manager; then
                 if \$DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -qx nginx-proxy-manager; then

scripts/lib/common.sh

@@ -100,7 +100,6 @@ mem_limit() {
   local low="${LOW_MEM:-false}"
   case "$name" in
     bitcoin|bitcoin-core|bitcoin-knots) $low && echo "4g"   || echo "8g" ;;
-    onlyoffice)          $low && echo "1g"   || echo "2g" ;;
     ollama)              $low && echo "1g"   || echo "4g" ;;
     lnd)                 echo "512m" ;;
     electrumx|mempool-electrs|electrs) echo "4g" ;;

scripts/nginx-https-app-proxies.conf

@@ -89,16 +89,6 @@ location /app/lnd/ {
     proxy_read_timeout 300s;
     proxy_send_timeout 300s;
 }
-location /app/onlyoffice/ {
-    proxy_pass http://127.0.0.1:9980/;
-    proxy_http_version 1.1;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_hide_header X-Frame-Options;
-    proxy_hide_header Content-Security-Policy;
-}
 location /app/jellyfin/ {
     proxy_pass http://127.0.0.1:8096/;
     proxy_http_version 1.1;