Feature request: allow third-party embed origins (Bandcamp, SoundCloud, Vimeo) — currently only YouTube can be embedded

[townsendjs]

Version: 0.0.14 · self-hosted, SQLite

Context

I teach web design at the university level and I'm building my own portfolio site on Instatic, partly to evaluate it for classroom use. I hit a wall embedding Bandcamp players on a music page.

What happens

A Bandcamp <iframe> (pasted from Bandcamp's own "Share / Embed" dialog) publishes into the page HTML correctly, but the browser blocks it and the player renders as blank space. Same would apply to SoundCloud and Vimeo.

Why

The published CSP is frame-src 'none' by default:

• src/core/publisher/cspPlan.ts → createBaseCspPlan() sets setCspDirective(plan, 'frame-src', ["'none'"])
• That's only relaxed by origins a module declares via cspSources, collected per page in src/core/publisher/renderNode.ts
• The only module that declares any is base.video, and only for YouTube — YOUTUBE_CSP_SOURCES in src/modules/base/video/index.ts

So the mechanism works exactly as designed and documented — it's just YouTube-only. There's no site-level setting to add other origins.

A plugin can't solve it either

I looked at writing a plugin module, since cspSources is part of the host ModuleDefinition render output. But the plugin path can't reach it:

• PluginRenderOutput in src/core/plugin-sdk/modules.ts has only html, css, js — no cspSources
• src/core/plugins/moduleAdapter.ts rebuilds the output explicitly: return { html: out.html, css: out.css, js: out.js } — anything else is dropped

I assume that's deliberate (a sandboxed third-party plugin shouldn't be able to widen the site's CSP), and it seems like the right call. Noting it so it's clear the plugin route isn't a workaround.

Possible directions

1. Add providers to base.video — it already accepts "paste a YouTube link"; Bandcamp/SoundCloud/Vimeo would fit the same prop and each declare their own origins. Smallest change, keeps CSP per-page and narrow.
2. A site-level embed allowlist — an explicit setting where the owner adds origins they trust. More flexible, still opt-in and auditable.
3. Let plugins declare cspSources behind a granted permission — most powerful, but the biggest security surface; probably not worth it versus option 1 or 2.

Option 1 would cover the common cases and keeps the existing "only pages that embed carry relaxed directives" property, which I think is a genuinely nice design.

Workaround I'm using

Album-art tiles that link out to Bandcamp instead of embedding. Fine visually, but visitors can't play a track without leaving the site.