Frame sites in the portal

The portal renders live, sandboxed iframe thumbnails of sites. For a site to be framable, it must be served with a Content-Security-Policy that allows the apex to frame it:

Content-Security-Policy: frame-ancestors https://<base>

Add the header at the proxy

gotifacts serves the site files; your reverse proxy adds the framing policy to site content responses (the *.base / *.*.base hosts).

nginx — replace any upstream CSP and set the framing policy:

proxy_hide_header Content-Security-Policy;
add_header Content-Security-Policy "frame-ancestors https://example.com" always;

Caddy:

header Content-Security-Policy "frame-ancestors https://example.com"

See the full nginx and Caddy guides for where this sits.

Use a static preview instead

If you’d rather not frame a site live — or it sets a stricter CSP itself — set the preview field in the site’s metadata to an image URL. The portal uses that image instead of a live iframe.

{ "group": "claude", "slug": "report", "title": "Report", "preview": "https://.../thumb.png" }