minor

CHANGELOG.md

@@ -573,27 +573,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-11-07
 
-### 🆕 New Scripts
-
-  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
-
 ### 🚀 Updated Scripts
 
-  - #### 🐞 Bug Fixes
-
-    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
-
   - #### 💥 Breaking Changes
 
     - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))
 
-### 💾 Core
-
-  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
-- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
-- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
-- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
-
 ## 2026-11-06
 
 ### 🚀 Updated Scripts

ct/romm.sh

@@ -107,9 +107,8 @@ function update_script() {
     ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
     ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
     if [[ -f /etc/angie/http.d/romm.conf ]]; then
-      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf ||
-        ! grep -q "coep_header" /etc/angie/http.d/romm.conf; then
-        msg_info "Updating Angie config (decode/cache locations, player isolation headers)"
+      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf; then
+        msg_info "Adding missing /decode and /cache locations to Angie config"
         dpkg -l angie-module-njs &>/dev/null || $STD apt install -y angie-module-njs
         grep -q "ngx_http_js_module.so" /etc/angie/angie.conf || sed -i '1i load_module modules/ngx_http_js_module.so;' /etc/angie/angie.conf
         mkdir -p /etc/angie/js "${ROMM_BASE}/cache"
@@ -148,20 +147,6 @@ map \$http_upgrade \$connection_upgrade {
     '' close;
 }
 
-# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
-# crossOriginIsolated document). Matched on \$request_uri because try_files
-# rewrites \$uri to /index.html before add_header runs, so a per-location
-# add_header on the player route never fires. Mirrors upstream RomM's
-# docker/nginx/templates/default.conf.template.
-map \$request_uri \$coep_header {
-    default        "";
-    ~^/rom/.*/(ejs|jsdos)(\?|\$) "require-corp";
-}
-map \$request_uri \$coop_header {
-    default        "";
-    ~^/rom/.*/(ejs|jsdos)(\?|\$) "same-origin";
-}
-
 server {
     listen 80;
     server_name _;
@@ -170,9 +155,6 @@ server {
 
     location / {
         try_files \$uri \$uri/ /index.html;
-        add_header Cache-Control "no-cache";
-        add_header Cross-Origin-Embedder-Policy \$coep_header;
-        add_header Cross-Origin-Opener-Policy \$coop_header;
     }
 
     location /assets {
@@ -182,6 +164,12 @@ server {
         add_header Cache-Control "public, immutable";
     }
 
+    location ~ ^/rom/.*/ejs\$ {
+        add_header Cross-Origin-Embedder-Policy "require-corp";
+        add_header Cross-Origin-Opener-Policy "same-origin";
+        try_files \$uri /index.html;
+    }
+
     location /api {
         proxy_pass http://romm_backend;
         proxy_buffering off;
@@ -221,7 +209,7 @@ server {
     }
 }
 EOF
-        msg_ok "Updated Angie config"
+        msg_ok "Added /decode and /cache locations"
       else
         sed -i -e "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" \
           -e "s|alias .*/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf

install/romm-install.sh

@@ -257,33 +257,15 @@ map $http_upgrade $connection_upgrade {
     '' close;
 }
 
-# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
-# crossOriginIsolated document). Matched on $request_uri because try_files
-# rewrites $uri to /index.html before add_header runs, so a per-location
-# add_header on the player route never fires. Mirrors upstream RomM's
-# docker/nginx/templates/default.conf.template.
-map $request_uri $coep_header {
-    default        "";
-    ~^/rom/.*/(ejs|jsdos)(\?|$) "require-corp";
-}
-map $request_uri $coop_header {
-    default        "";
-    ~^/rom/.*/(ejs|jsdos)(\?|$) "same-origin";
-}
-
 server {
     listen 80;
     server_name _;
     root /opt/romm/frontend/dist;
     client_max_body_size 0;
 
-    # Frontend SPA - also emits the player isolation headers: the player URLs
-    # fall through try_files to /index.html, which this location serves
+    # Frontend SPA
     location / {
         try_files $uri $uri/ /index.html;
-        add_header Cache-Control "no-cache";
-        add_header Cross-Origin-Embedder-Policy $coep_header;
-        add_header Cross-Origin-Opener-Policy $coop_header;
     }
 
     # Static assets
@@ -294,6 +276,13 @@ server {
         add_header Cache-Control "public, immutable";
     }
 
+    # EmulatorJS player - requires COOP/COEP headers for SharedArrayBuffer
+    location ~ ^/rom/.*/ejs$ {
+        add_header Cross-Origin-Embedder-Policy "require-corp";
+        add_header Cross-Origin-Opener-Policy "same-origin";
+        try_files $uri /index.html;
+    }
+
     # Backend API
     location /api {
         proxy_pass http://romm_backend;