allow iFrame (xframe = ALLWALL)?

[cyberthom42]

I would like to display Tandoor inside a dashboard as an iframe. How can I allow iframe integration? There is a Django option called xframe. I already tried the following environment setting:
DJANGO_X_FRAME_OPTIONS: 'ALLOWALL'
But this does not help

[vabene1111]

Currently not, might be something for the future

[floetenmaul]

Would be great to have this. Would allow Tandoor to be used directly in Home Assistant dashboard.

[koenieee]

Yes same, why is it not supported?

[smilerz]

it adds all sorts of security problems

[AdamantUnstable]

For anyone looking to do this, a somewhat hacky but effective way is to manually add the config to the server you're running. For instance, if using the docker compose "plain" setup with Nginx you can manually add
add_header Content-Security-Policy "frame-ancestors domain.com";
to the Recipes.conf file inside the tandooor_nginx_config volume (replace domain.com with the domain your dashboard is running on - this is more secure than allowing all domains).

(Easiest way to edit a volume is to fire up a one-shot container, something like this:
docker run --rm -it -v tandoor_nginx_config:/nginx bash to fire up the Docker bash container and mount the Nginx config under /nginx, the config file will be under /nginx/Recipes.conf assuming your volume names are the same as mine)