Trust nginx proxy and drop hotlink response headers from Nest.

Rate limits use X-Forwarded-For behind prod nginx; hotlink security headers are set on /i/ in nginx only.

backend/src/main.ts

@@ -57,6 +57,8 @@ async function bootstrap() {
         credentials: true
     });
 
+    app.set('trust proxy', 1);
+
     await app.listen(port);
 }
 

backend/src/modules/upload/controllers/HotlinkImageController.ts

@@ -1,4 +1,4 @@
-import { Controller, Get, Header, Param, StreamableFile } from '@nestjs/common';
+import { Controller, Get, Param, StreamableFile } from '@nestjs/common';
 import { HotlinkImageParamsDto } from '../dto/HotlinkImageParamsDto';
 import { UploadService } from '../services/UploadService';
 
@@ -7,9 +7,6 @@ export class HotlinkImageController {
     constructor(private readonly uploadService: UploadService) {}
 
     @Get(':id/:secret')
-    @Header('X-Content-Type-Options', 'nosniff')
-    @Header('Content-Security-Policy', 'sandbox')
-    @Header('Referrer-Policy', 'no-referrer')
     async getImage(@Param() params: HotlinkImageParamsDto): Promise<StreamableFile> {
         const { body, mimeType } = await this.uploadService.getHotlinkImage(params.id, params.secret);