Local setup: Allow-Access-Control-Origin is set to '*'

[mszulik]

This means all websites can embed videos. We could provide a way to configure this with NGINX maps.

Our image has two directories for NGINX configuration files which will be automatic loaded.

For global configuration options the directory /opt/docker/etc/nginx/conf.d can be used. For vhost configuration options the directory /opt/docker/etc/nginx/vhost.common.conf can be used. We'll have to check where to include the map. The variable provided by the map can then be used in the docker/location-root.conf file instead of the asterisk.

With the map, we could map the incoming Host Header to values, which can then be used as value for the Allow-Access-Control-Origin header. For the default, i.e. the Host header could not be mapped, we can just leave it empty and it should be denied (has to be tested).